● Covered by 2 sources · 2 reportsMedium impact2 negative
BTCPay Server warns users of hot wallet crypto thefts on outdated instances
Key points
- Hot wallets on BTCPay Server instances 2.4.1 or older are being drained.
- Attackers gained administrator access to vulnerable servers.
- Users are urged to update to version 2.4.7 to prevent further thefts.
- The project is investigating the attack vector and assisting affected users.
- BTCPay Server is a self-hosted, open-source cryptocurrency payment processor.
- The vulnerability was fixed in version 2.4.2, released on August 7, 2026.
- Attacks targeted servers running BTCPay Server 2.4.1, released on July 23, 2026.
- Users should migrate to a new server and wallet, considering all secrets compromised.
- Reports of attacks began surfacing around November 1, 2026.
Ongoing Crypto Thefts Reported
BTCPay Server, an open-source cryptocurrency payment processor, has issued a warning regarding ongoing thefts from "hot wallets" on instances running outdated software. The maintainer initially advised users to shut down their servers while an investigation into unauthorized Bitcoin and Litecoin payments was conducted. Reports of thefts began to surface, leading to a swift response from the project.
Vulnerability Identified
The BTCPay Server maintainer identified an attack vector targeting instances running version 2.4.1 (released July 23, 2026) or earlier. The investigation focused on determining how threat actors were able to log in as administrators to these older instances. BTCPay founder Nicolas Dorier confirmed that the attacks did not target public servers, indicating a specific vulnerability in older versions.
Emergency Security Update
An emergency security update, version 2.4.7, was released following the discovery of a critical vulnerability via Anthropic's Frontier OSS scanner on October 29. While this update addresses the immediate threat, clues suggest attackers exploited vulnerabilities in BTCPay Server versions earlier than 2.4.2, released on August 7. The project has confirmed these earlier vulnerabilities were the target.
Call to Action for Users
BTCPay Server strongly urges all users to update their instances to version 2.4.7. The project states there are no credible reports of hot wallet drains for users running the latest release. Impacted users can update via Server Settings → Maintenance → Update, or by logging in over SSH for Docker installations. Users who have lost funds are asked to report details to security@btcpayserver.org and local authorities.
Updates
- BTCPay Server is a self-hosted, open-source cryptocurrency payment processor.
- The vulnerability was fixed in version 2.4.2, released on August 7, 2026.
- Attacks targeted servers running BTCPay Server 2.4.1, released on July 23, 2026.
- Users should migrate to a new server and wallet, considering all secrets compromised.
- Reports of attacks began surfacing around November 1, 2026.
✨ This summary was generated by AI from the outlets' reporting listed below. It is not independently verified and may contain errors — check the original sources. How BrevFeed works →
The daily brief
One email each morning: the day's tech stories, clustered across outlets and summarized. No account needed.
One email a day. Unsubscribe in one click, any time.
Today's brief
Spend a few minutes, get the whole day. Every topic's top stories in one hands-free rundown — listen, watch, or read the transcript.
▶ Play today's brief
New every morning, and the back catalogue is archived by date.
How outlets covered it
BTCPay Server has urged users to update their software after attackers exploited a vulnerability in versions 2.4.1 and earlier, resulting in the theft of Bitcoin and Litecoin from hot wallets. Users running affected versions are advised to migrate to a new server and wallet, as all secrets on compromised machines should be considered compromised.
BTCPay Server, an open-source cryptocurrency payment processor, has warned users about hot wallet crypto thefts affecting instances running versions 2.4.1 or older. The project identified an attack vector allowing unauthorized access and urged all users to update to version 2.4.7 immediately. The attacks led to Bitcoin and Litecoin being drained from hot wallets, prompting an investigation into how attackers gained administrator access.