BTCPay Server's investigation has identified an attack vector targeting instances running version 2.4.1, released on July 23, 2026, or older, after reports that unauthorized attackers were sweeping hot wallets.
The open-source cryptocurrency payment processor said it has no credible reports of hot wallet drains affecting users running the latest 2.4.7 release. The company has not disclosed how much was lost or how many servers were affected.
What the team has said
BTCPay Server is urging all operators to keep their instances updated and has asked affected users to send full details and logs to [email protected]. Earlier in the incident, the platform had urged users to shut down their instances until the investigation was complete.
Founder Nicolas Dorier said public servers running version 2.4.7 were not attacked and that the reports appear to predate version 2.4.2.
“Update on my part: Our public servers were not attacked (on 2.4.7), it seems reports are before 2.4.2. The attacker managed to log in as admin on those instance, we are still trying to figure out how… We have traces that pre 2.4.2 vulnerabilities were used. We will communicate more in a following blog post.”
About the platform
BTCPay Server is a free, self-hosted, open-source Bitcoin payment processor that lets individuals and merchants accept Bitcoin and Lightning Network payments without relying on third-party intermediaries. Payments go directly to connected wallets, with no subscription or transaction fees beyond standard network charges. The platform also offers tools for managing invoices, point-of-sale payments, crowdfunding campaigns, and tips.
Earlier security issues
The latest development comes about three months after BTCPay Server disclosed a vulnerability that was exploited to steal funds from some users. That flaw allowed attackers to obtain LND admin macaroon credentials from affected instances and use them to access connected LND wallets.
The incident also follows by days the Binance hack, in which an exploiter drained more than $6 billion in crypto assets. Described as the largest exploit in crypto history, the heist has been attributed by the FBI and security analysts to TraderTraitor, a state-sponsored cyber warfare group linked to North Korea.
