BTCPay Server, the open-source Bitcoin payment processing software, has identified an attack vector affecting installations running version 2.4.1 or earlier. The project reported unauthorized withdrawals from users’ hot wallets and urged operators to take immediate protective steps.

Version 2.4.1 was released on July 23, 2026. BTCPay Server stated that its latest release, version 2.4.7, has produced no credible reports of hot wallet drains among users. Operators still running outdated software were instructed to shut down their instances and upgrade without delay.

Initial Shutdown Order and Investigation Progress

On Sunday, BTCPay Server issued an alert describing reports of unauthorized sweeps from hot wallets hosted on its instances. The project directed operators to stop services using the command ./btcpay-down.sh until the investigation concluded. Later updates clarified that the attack vector specifically targeted older releases.

BTCPay Server founder Nicolas Dorier stated that reports of the thefts appear to involve releases older than version 2.4.2. He confirmed that the project’s public servers running version 2.4.7 were not attacked. Dorier noted that an attacker had logged in as an administrator on affected instances, though the method used to obtain that access remained undetermined at the time of the statement.

The team has not disclosed the number of affected operators or the total value of cryptocurrency removed. It continues to examine the technical details of the wallet access and has invited impacted users to submit logs and information to its security team.

Version Status and Recommended Actions

BTCPay Server recommended that all operators install the current release. Users running version 2.4.7 reported no credible incidents of hot wallet theft. Those still on earlier versions were told that remaining online without an update left funds exposed to ongoing attacks.

BTCPay Server is a self-hosted platform that enables businesses and individuals to accept Bitcoin and Lightning Network payments on their own infrastructure. Its hot-wallet configuration stores a wallet seed on the server so transactions can be signed quickly, a design that increases exposure compared with offline storage methods.

Prior Security Event

The latest findings follow an earlier incident in August. At that time, attackers exploited a flaw to obtain Lightning Network Daemon credentials and move funds. BTCPay Server responded by restricting remote Lightning access. The project has not confirmed whether the current attack vector is connected to that prior event.

Operators were again encouraged to supply relevant security logs to assist the ongoing review. The team continues to work on identifying the root cause while pressing all users to move to the latest software version.