"We have identified an attack vector targeting instances running version 2.4.1 (Jul 23, 2026) or older," the BTCPay Server maintainer warned, urging users to update immediately to 2.4.7.
Maintainer alert and the scale of the problem
The open-source BTCPay Server project — a self-hosted cryptocurrency payment processor used to accept Bitcoin and other digital assets directly into merchants' own wallets — has reported that attackers are draining "hot wallets" on instances running outdated software. Operators were initially advised to shut down their servers pending a full investigation into unauthorized payments. The project said it has "no credible reports of hot wallet drains for users running the latest 2.4.7 release" and again urged everyone to keep their BTCPay Server updated.
Versions 2.4.1 (Jul 23, 2026) and earlier: how attackers gained access
BTCPay founder Nicolas Dorier said the attacks did not target public servers and that the investigation has focused on how the threat actor was able to log in as an administrator to instances running versions older than 2.4.2. The project reported clues that the attacker used vulnerabilities present in BTCPay Server versions earlier than 2.4.2 and later confirmed an attack vector impacting instances running 2.4.1 or older.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleAnthropic’s Frontier OSS scanner and the emergency 2.4.7 release
On October 29, BTCPay Server disclosed a critical vulnerability discovered via Anthropic’s Frontier OSS scanner. That disclosure prompted the release of version 2.4.7 as an emergency security update. The project had previously warned, on August 7 when releasing version 2.4.2, about an actively exploited flaw that exposed LND credential files — a flaw that allowed attackers to control affected Lightning nodes and steal funds. The maintainers have not clarified which specific flaw is being exploited in the recent hot-wallet drains.
Operational guidance: update paths, Docker commands, and containment
BTCPay Server provided concrete update instructions for administrators. For standard instances, update via Server Settings → Maintenance → Update. For Docker deployments, administrators should log in over SSH, run sudo su -, change to the deployment directory with cd btcpayserver-docker, and execute ./btcpay-update.sh. The project recommends that any instance running 2.4.1 or older be taken offline as soon as possible. Impacted users are asked to send all details and activity logs to security@btcpayserver.org.
What this means for operators, security teams, and merchants
- Operators and self-hosters: Those running BTCPay Server must verify their version and apply 2.4.7 immediately. Operators on 2.4.1 or older are advised to take instances offline and gather logs for incident response.
- Security teams and incident responders: Teams should prioritize analysis of admin login activity and correlated logs, and forward findings to the project at security@btcpayserver.org. The presence of an administrative login vector in versions earlier than 2.4.2 is the focal point of the investigation.
- Merchants using Lightning and hot wallets: Merchants accepting Lightning Network payments should confirm they are not running affected releases and monitor for any unauthorized payments; the project has specifically noted prior exploitation that exposed LND credentials and led to theft from Lightning nodes.
Outstanding technical questions and immediate next steps
The project has not yet specified the exact flaw currently being exploited in the hot-wallet drains. BleepingComputer contacted BTCPay Server for more details about the vulnerability exploited in the current attacks but had not received a response by publication time. For now, the record is clear on three points: the attack targets outdated instances (2.4.1 and earlier), 2.4.7 was released as an emergency update after a critical disclosure on October 29, and administrators should update or take affected instances offline and send logs to security@btcpayserver.org.
For operators who run their own payment infrastructure, the practical step is straightforward and uncompromising: check your BTCPay Server version, apply 2.4.7 without delay, and forward any incident data to the project so investigators can close the gap in public knowledge about the exploited flaw.
