- Published on
BTCPay Server warns of hot wallet thefts running on outdated software
- Authors
- Name
- DeepHorus
BTCPay Server warned Monday that attackers are draining funds from hot wallets on installations running outdated software. The project identified an attack vector affecting version 2.4.1 or earlier, released July 23, 2026. It reported no credible hot wallet drains on version 2.4.7 and urged operators to update.
The warning followed reports of unauthorized withdrawals from usersā hot wallets. BTCPay asked affected users to submit information and logs to its security team. It has not disclosed the number of affected operators, stolen funds, or technical details of how attackers accessed wallets.
Earlier, BTCPay urged operators to shut down server instances while it investigated the withdrawal reports. It also shared shutdown instructions. The project has not said whether the latest vector is connected to an August attack that exploited a vulnerability to obtain Lightning Network Daemon credentials and steal funds.
The disclosure matters because BTCPay is a Bitcoin payment platform, and hot wallet compromises can let attackers drain funds directly. Operators still running version 2.4.1 or earlier remain exposed. The projectās guidance is to update installations, with version 2.4.7 as the latest release.
BTCPay has not provided a full account of the incidentās scope, leaving affected operators and observers unable to assess total losses. Cointelegraph reached out to BTCPay for comment but did not receive a response before publication. The project directed affected users to provide logs and other information to its security team.
The warning comes less than three months after BTCPay restricted remote Lightning access following the August attack, which involved stolen LND credentials and funds. It remains unclear whether the two security issues are related. Operators are expected to update or keep servers offline until they confirm a secure version.
