BTCPay Server has identified an attack vector affecting older versions of its payment software after receiving reports of unauthorized withdrawals from users’ hot wallets.
The Bitcoin payment platform said its investigation found the attack targeted server instances running version 2.4.1 or earlier. That release was issued on July 23, 2026. BTCPay urged operators using potentially affected versions to shut down their servers and update their installations.
The project said it had not received credible reports of hot wallet drains involving users running its latest release, version 2.4.7. It had previously issued a warning asking operators to take their server instances offline while the investigation into the unauthorized withdrawals continued, and provided shutdown instructions.
BTCPay Server has not disclosed how many operators may be affected, the amount of funds allegedly stolen or the technical method used to access the wallets. It asked affected users to send relevant information and logs to its security team.
The reports follow an earlier incident, less than three months ago, in which BTCPay restricted remote Lightning access after an August attack exploited a vulnerability to obtain Lightning Network Daemon credentials and steal funds. It remains unclear whether that vulnerability is connected to the latest attack vector.
Sources: Cointelegraph.