Key facts
- BTCPay Server said the attack vector targets instances running version 2.4.1 or earlier, released July 23, 2026.
- BTCPay Server said it had received no credible reports of hot wallet drains among users running version 2.4.7.
- BTCPay Server has not disclosed the number of affected operators or the value of stolen funds.
- BTCPay Server asked affected users to submit information and logs to its security team.
- BTCPay Server restricted remote Lightning access after an August attack that obtained LND credentials and stole funds.
BTCPay Server said on Monday that it had identified an attack vector affecting older versions of its Bitcoin payment software, after receiving reports of attackers draining funds from users' hot wallets. The project said the vector targets instances running version 2.4.1 or earlier, which was released July 23, 2026.
BTCPay Server said it had received no credible reports of hot wallet drains among users running its latest release, version 2.4.7, and urged operators to update their installations. The findings followed an earlier warning in which BTCPay urged operators to shut down server instances while it investigated the unauthorized withdrawal reports, and shared instructions for doing so.
BTCPay Server has not disclosed the number of affected operators, the value of stolen funds or technical details explaining how attackers accessed the wallets. It asked affected users to submit information and logs to its security team. Cointelegraph reported that it reached out to BTCPay Server for comment and did not receive a response before publication.