BTCPay Server Flags Hot Wallet Risks from Outdated Software

Security Alert: BTCPay Server Urges Operators to Update Amid Hot Wallet Drain Reports

BTCPay Server has issued an urgent warning to its operators, advising them to shut down their servers immediately following reports of unauthorized attackers draining funds from user hot wallets. The Bitcoin payment platform has identified a specific attack vector that appears to affect older versions of its payment software.

Vulnerability Identified in Older Versions

An investigation by BTCPay Server revealed that instances running version 2.4.1 or earlier of its software are vulnerable. This particular version was released on July 23, 2026. The project stated that it has received no credible reports of hot wallet drains among users operating its latest release, version 2.4.7, and strongly urged all operators to update their installations promptly.

Initial Shutdown Advisory and Ongoing Investigation

These findings follow an earlier advisory where BTCPay Server initially recommended operators shut down their server instances while the security team investigated the unauthorized wallet withdrawal reports. The company also provided instructions on how to safely take servers offline.

BTCPay Server has not yet disclosed the number of operators affected by the breach, the total value of the stolen funds, or specific technical details regarding how the attackers gained access to the wallets. The company has requested that affected users submit relevant information and system logs to its security team to aid in the investigation.

Context of Recent Security Incidents

The current security alert comes less than three months after BTCPay Server implemented restrictions on remote Lightning access. This measure was a response to an August attack that exploited a vulnerability to compromise Lightning Network Daemon (LND) credentials and subsequently steal funds. It is currently unclear whether the newly identified attack vector is linked to the August vulnerability.