BTCPay Server Attack Hits Old Versions: Update Now

A BTCPay Server attack is draining hot wallets on versions 2.4.1 or earlier. Operators are urged to update to 2.4.7, which has no credible drain reports.

A BTCPay Server attack has been draining funds from hot wallets, and the project is pointing operators of older software toward an immediate update. The open-source bitcoin payment tool says the attack vector affects instances running version 2.4.1 or earlier, and it is urging everyone to move to version 2.4.7.

What happened in the BTCPay Server attack

BTCPay Server received reports of unauthorized attackers draining funds from users' hot wallets. In response, the project identified an attack vector tied to instances running version 2.4.1 or earlier — a release dated July 23, 2026. The team's guidance was blunt: update your installation.

The project also took a more drastic step earlier in its investigation, urging operators to shut down server instances and publishing shutdown instructions. That is a meaningful signal. When a payment processor tells merchants to take servers offline, it is prioritizing containment over uptime.

BTCPay's founder said the reports appear to involve versions older than 2.4.2, which lines up broadly with the project's own threshold of 2.4.1 or earlier. The two statements are consistent in direction, even if the exact version boundary is described slightly differently.

Why it matters for merchants and holders

BTCPay Server is not a household name, but it sits underneath real commerce. It is an open-source bitcoin payment tool that lets merchants accept BTC without a custodial intermediary. When a self-hosted payment stack is compromised, the losses land on the operator, not on a centralized exchange's insurance fund.

Hot wallets are the crux here. These are wallets connected to a running server so they can receive and move funds — convenient for payments, exposed by design. The project says it has no credible reports of hot wallet drains among users running version 2.4.7, which is the strongest argument for updating immediately.

There is also a track record to weigh. Less than three months before these reports, BTCPay restricted remote Lightning access after an August attack that exploited a vulnerability to obtain Lightning Network Daemon (LND) credentials and steal funds. It remains unclear whether the latest attack vector is connected to that August vulnerability. Analysts and operators should treat that as an open question rather than assume either way.

Version 2.4.1 or earlier: the threshold BTCPay cites as affected.
Version 2.4.7: the latest release, with no credible drain reports so far.
August attack: a separate incident that exposed LND credentials.
Undisclosed: number of affected operators, value of stolen funds, and technical details of wallet access.

Market reaction

Bitcoin is trading at $78,076.00, up 0.28% over 24 hours on volume of $17,020,785,879 and a market cap of $1,569,747,655,928. That is a calm tape. There is no visible risk-off move tied to this incident, which fits the scale of the disclosure so far: no loss figure, no confirmed count of victims, and no technical write-up.

For traders, the read-through is limited but not zero. Incidents at self-hosted infrastructure rarely move BTC price directly, yet they do shape sentiment around self-custody tooling and merchant adoption. If losses turn out to be large or widespread, expect the conversation to shift toward how small operators secure hot wallets.

What to watch next

The most important unknowns are still unknown. BTCPay has not disclosed how many operators were affected, how much was stolen, or how attackers accessed wallets. CoinDesk reported the project is still investigating and has not given a loss figure or announced a fix. Cointelegraph did not receive a response from BTCPay Server before publication.

Three things are worth tracking:

Disclosure of scope. A victim count or loss estimate would tell us whether this is a handful of misconfigured servers or something broader.
Technical detail. A post-mortem would clarify whether the vector overlaps with the August LND credential issue.
Patch confirmation. Operators running 2.4.7 have the project's assurance of no credible drain reports, but clarity on a formal fix would settle the question.

If you run BTCPay, the practical checklist is short: confirm your version, update to 2.4.7, and if you were affected, send information and logs to the project's security team. Consider whether funds sitting in a server-connected hot wallet need to be there at all. That is risk management, not a prediction.

FAQ

What is the BTCPay Server attack?

It is a reported attack vector that lets unauthorized attackers drain funds from hot wallets on BTCPay Server instances running version 2.4.1 or earlier. The project identified the vector after receiving reports of drains and urged operators to update to version 2.4.7.

Why did BTCPay Server tell operators to shut down servers?

While investigating, the project urged operators to shut down server instances and shared shutdown instructions. That is a containment measure: taking a payment server offline stops it from moving funds while the team works out what is happening.

How does updating to version 2.4.7 reduce the risk?

BTCPay says it has no credible reports of hot wallet drains among users running version 2.4.7, while the identified attack vector targets version 2.4.1 or earlier. Updating moves an operator off the affected version range, though the project has not published full technical details of the exploit.

Market snapshot

Prices at the time of writing (Nov 2, 2026 08:00 UTC).

Bitcoin (BTC): $78,076.00 — 24h +0.28%

Trade BTC now →

BTCPay Server Attack Drains Hot Wallets on Old Versions