BTCPay Server has warned that attackers have been draining funds from users’ hot wallets and identified an attack vector affecting older versions of its Bitcoin payment software. The project urged operators to update their installations.
On Monday, BTCPay Server said its investigation found the attack vector targets instances running version 2.4.1 or earlier, which was released on July 23, 2026. The project said it had received no credible reports of hot wallet drains among users running its latest release, version 2.4.7.
Earlier shutdown warning
The findings followed an earlier warning in which BTCPay urged operators to shut down server instances while it investigated reports of unauthorized wallet withdrawals. It also shared instructions for operators to shut down their servers.
BTCPay has not disclosed the number of affected operators, the value of stolen funds or technical details explaining how attackers accessed the wallets. It asked affected users to submit information and logs to its security team.
A request for comment did not receive a response before publication.
Prior Lightning incident
The reports come less than three months after BTCPay restricted remote Lightning access following an August attack that exploited a vulnerability to obtain Lightning Network Daemon (LND) credentials and steal funds. It remains unclear whether the latest attack vector is connected to the August vulnerability.
