BTCPay Server warns of hot wallet thefts targeting outdated instances

What it is

BTCPay Server's maintainers say attackers are draining hot wallets on instances running version 2.4.1 (July 23, 2026) or older. The project's incident response identified an attack vector against those versions. It reports no credible hot wallet drains on 2.4.7, the release it tells everyone to run. Operators were first told to shut servers down pending the investigation.

Preconditions / Affected

• Instances on 2.4.1 or earlier are the ones attacked. The investigation centred on how the attacker logged in as an administrator on versions older than 2.4.2.
• Founder Nicolas Dorier said the attacks did not target public servers. The page does not say what that means for exposure.
• The relevant wallets are hot wallets, including funds reachable through Lightning.

What to do

Update to 2.4.7 from the web UI: Server Settings → Maintenance → Update.

For Docker deployments, log in over SSH and run:

sudo su -
cd btcpayserver-docker
./btcpay-update.sh

If you are on 2.4.1 or older, the page recommends taking the instance offline as soon as possible. Affected users should send all details and activity logs to security@btcpayserver.org.

Check your version first. Instances already on 2.4.2 through 2.4.6 fall outside the stated attack boundary but still lack the 2.4.7 emergency fix. That fix addressed a separate critical vulnerability disclosed October 29, found by Anthropic's Frontier OSS scanner.

Caveats

• The project has not said which flaw the attackers exploited. BleepingComputer asked and had no reply by publication.
• The attack does not appear to be the October 29 vulnerability. Dorier saw clues pointing to flaws in versions before 2.4.2, and the project later confirmed this.
• The August 7 release 2.4.2 had warned of an actively exploited flaw that exposed LND credential files. That let attackers control Lightning nodes and steal funds. The page does not link it to the current thefts.
• Updating does not recover funds already taken, and the page gives no guidance on rotating credentials after an update.