The maintainers of BTCPay Server, an open-source cryptocurrency payment processor, have issued a urgent warning to users to update their software after hackers exploited vulnerabilities in outdated versions to steal funds from hot wallets.
Users running versions 2.4.1 (released on July 23, 2026) or earlier were advised to shut down their servers immediately while the team investigates unauthorized Bitcoin and Litecoin transactions. The latest version, 2.4.7, was released as an emergency update on October 29 following the discovery of a critical vulnerability through Anthropic’s Frontier OSS scanner.
BTCPay Server founder Nicolas Dorier confirmed that the attacks did not target public servers but focused on instances running versions older than 2.4.2. The investigation revealed that the attackers gained administrative access to these outdated systems. The project has not received reports of hot wallet drains for users running the latest version, 2.4.7.
Users affected by the thefts are encouraged to report their losses to security@btcpayserver.org and local authorities. Updates can be performed through Server Settings or via Docker installations by running the update script. The maintainers continue to respond to incident reports and urge all users to keep their software updated.