BTCPay Server identified an attack vector hitting hot wallets on versions 2.4.1 and earlier, urging operators to update to 2.4.7 after a 2nd security incident in 2026.
Key Facts
BTCPay Server identified an attack vector affecting instances running version 2.4.1 or earlier, released July 23, 2026, but has received no credible reports of drains on the current 2.4.7 release.
The warning follows an earlier alert telling operators to shut down affected servers while BTCPay investigated reports of attackers draining funds from users’ hot wallets.
The reports surface less than three months after BTCPay restricted remote Lightning access following an August attack that stole funds via exposed LND credentials.
BTCPay Server has identified an attack vector affecting older versions of its self-hosted payment software after receiving reports of attackers draining funds from users’ hot wallets, a form of bug exploit tied to outdated code rather than the underlying Bitcoin network.
Second Alert Narrows the Affected Versions
The open-source Bitcoin (BTC) payment platform said on X Monday that its investigation traced the issue to instances running version 2.4.1 or earlier, a build released July 23, 2026. BTCPay said it has not received credible reports of hot wallet drains from operators running its current release, version 2.4.7, and urged all operators still on older builds to update immediately.
https://x.com/BtcpayServer/status/2117106238123123008
The disclosure followed an earlier warning on X in which BTCPay told operators to shut down their servers while it investigated reports of unauthorized withdrawals, sharing shutdown instructions for those unable to patch right away.
https://x.com/BtcpayServer/status/2117020340815819262
BTCPay has not disclosed how many operators were affected, the value of funds stolen, or the technical mechanism attackers used to reach the wallets. The project asked affected users to submit logs and other information to its security team to aid the investigation.
Second Incident in Three Months
The incident marks the second security event tied to BTCPay Server in under three months. In August, the project restricted remote access to Lightning Network Daemon (LND) nodes after attackers exploited a flaw to obtain LND credential files and drain Lightning channels from merchants including hardware wallet maker Foundation. That attack did not affect on-chain hot wallets, which BTCPay confirmed at the time were untouched.
It remains unclear whether the latest hot wallet attack vector is connected to the August Lightning vulnerability, and BTCPay has not indicated that the two incidents share a root cause.
BTCPay Server underpins Bitcoin checkout for merchants, exchanges, and wallet back-ends that self-host the software rather than relying on a custodial processor. Operators who run their own node are responsible for applying security patches themselves, since BTCPay cannot push updates to self-hosted instances directly. This stands in contrast to how a true air gap setup works, where an offline wallet cannot be reached by a software-level attack vector at all because it has no network connection to exploit.
For operators who generated a hot wallet inside BTCPay on an affected version, the standard guidance after a credential-related incident has been to move funds to a new wallet rather than assume a software update alone resolves the exposure, since compromised credentials or keys do not necessarily expire when the underlying software is patched.
This article contains links to third-party websites or other content for information purposes only (“Third-Party Sites”). The Third-Party Sites are not under the control of CoinMarketCap, and CoinMarketCap is not responsible for the content of any Third-Party Site, including without limitation any link contained in a Third-Party Site, or any changes or updates to a Third-Party Site. CoinMarketCap is providing these links to you only as a convenience, and the inclusion of any link does not imply endorsement, approval or recommendation by CoinMarketCap of the site or any association with its operators. This article is intended to be used and must be used for informational purposes only. It is important to do your own research and analysis before making any material decisions related to any of the products or services described. This article is not intended as, and shall not be construed as, financial advice. The views and opinions expressed in this article are the author’s [company’s] own and do not necessarily reflect those of CoinMarketCap.
