Overview
The maintainer of BTCPay Server, the open-source cryptocurrency payment processor, is urging users to install the latest release after attackers began draining hot wallets on instances running older versions.
The project says it identified an attack vector targeting instances on version 2.4.1 (July 23, 2026) or earlier. The founder also reports signs that flaws in versions before 2.4.2 (released August 7) were exploited.
What We Know
- Attackers logged in as administrators on older instances and made unauthorized Bitcoin and Litecoin payments from hot wallets
- The specific vulnerability has not been named and no CVE has been published
- The founder says the attacks did not target public servers; the investigation into how admin access was obtained continues
- No total loss figure has been disclosed
Separately, an emergency release, 2.4.7, shipped after a critical vulnerability was disclosed on October 29. That bug was found by Anthropic's Frontier OSS scanner.
Recommended Actions
- Update to 2.4.7 via Server Settings → Maintenance → Update
- For Docker deployments, SSH in, run
sudo su -, change to thebtcpayserver-dockerdirectory, and run./btcpay-update.sh - If running 2.4.1 or older, take the instance offline as soon as possible
- Review admin accounts, API keys, and recent payouts for anything unexpected
- Keep only operating balances in hot wallets
Victims who lost funds should email security@btcpayserver.org and report the losses to local authorities.