The maintainer of BTCPay Server, an open-source cryptocurrency payment processor, has urged users to install the latest version as hackers have been draining “hot wallets” on instances running older versions.
Operators were initially advised to shut down their servers pending a full investigation into the unauthorized payments.
The BTCPay Server project provides businesses with a self-hosted payment processing solution that allows them to accept Bitcoin and other digital assets directly into their own wallets, eliminating payment intermediaries or paying platform processing fees.
It handles checkout invoices and payment verification, including payments over the Lightning Network.
Early Monday, the maintainer said it had “identified an attack vector targeting instances running version 2.4.1 (July 23, 2026) or earlier” and strongly urged users to update to version 2.4.7.
BTCPay founder Nicolas Dorier said the attacks did not target public servers. The investigation focused on determining how the threat actor was able to log in as an administrator to instances running versions older than 2.4.2.
On October 29, the company disclosed a critical vulnerability discovered via Anthropic’s Frontier OSS scanner, which prompted the release of version 2.4.7 as an emergency security update.
However, Dorier said that there were clues that the attacker used vulnerabilities in BTCPay Server versions earlier than 2.4.2, which the project later confirmed.
“Our incident response investigation identified an attack vector targeting instances running versions 2.4.1 (Jul 23, 2026) or older,” BTCPay Server says.
“We have no credible reports of hot wallet drains for users running the latest 2.4.7 release. We again urge everyone to keep their BTCPay Server updated.”
Impacted users are requested to send all details and activity logs to [email protected].
It is worth noting that on August 7, when BTCPay Server released version 2.4.2, it warned about an actively exploited flaw exposing LND credential files that allowed attackers to control affected Lightning nodes and steal funds.
The project has not clarified what flaw is being exploited in the recent attacks.
BleepingComputer has contacted BTCPay Server for more details about the vulnerability exploited in the current attacks, but we have not received a response by publication time.
Impacted users should update to version 2.4.7 through Server Settings → Maintenance → Update.
For Docker installations, administrators can update BTCPay Server by logging in over SSH, running sudo su -, changing to the deployment directory with cd btcpayserver-docker, and executing ./btcpay-update.sh.
If running 2.4.1 or older, it is recommended to take the instance offline as soon as possible.
Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.