BTCPay Server has identified a security vulnerability affecting older versions of its payment software, specifically instances running version 2.4.1 or earlier, which was released on July 23, 2026. The project reported receiving credible accounts of attackers draining funds from users’ hot wallets through this attack vector. In response, BTCPay urged operators to immediately update their installations to the latest release, version 2.4.7, noting that no such thefts have been reported among users running this current version.
Prior to confirming the specific affected versions, BTCPay had issued an initial warning advising operators to shut down their server instances while the investigation into unauthorized wallet withdrawals proceeded. The organization provided instructions for safely taking servers offline during this period. As of the announcement, BTCPay has not disclosed the total number of affected operators, the aggregate value of stolen funds, or technical details regarding how attackers accessed the wallets. The project has requested that affected users submit information and logs to its security team to aid in the ongoing analysis.
This development occurs less than three months after BTCPay restricted remote Lightning access following an August attack. That previous incident exploited a vulnerability to obtain Lightning Network Daemon (LND) credentials, resulting in fund theft. It remains unclear whether the newly identified attack vector targeting hot wallets is connected to the earlier August vulnerability.
The identification of a specific attack vector tied to outdated software highlights the persistent operational risk faced by self-hosted cryptocurrency infrastructure providers. Unlike centralized exchanges with dedicated security teams managing patches, BTCPay Server relies on individual merchants to maintain their own installations. The gap between the release of vulnerable code in July 2026 and the discovery of active exploitation suggests that attackers are systematically scanning for and targeting legacy systems that have fallen behind on updates.
From a Credibility perspective, the lack of disclosed metrics regarding the number of victims or the total value of stolen assets creates uncertainty within the merchant community. While the prompt recommendation to upgrade to version 2.4.7 mitigates future risk, it does not address the potential reputational damage if the scale of the theft proves significant. Furthermore, the ambiguity surrounding any connection to the prior August LND credential exploit complicates the assessment of whether these are isolated incidents or part of a broader campaign against BTCPay’s architecture.
