BTCPay Server has issued a critical warning to its users after reports of unauthorized attackers draining funds from hot wallets running on outdated software. The Bitcoin payment platform identified an attack vector affecting versions 2.4.1 or earlier, which was released on July 23, 2026. The latest version, 2.4.7, has not reported any credible instances of hot wallet drains, prompting BTCPay to urge operators to update their installations immediately.
The platform initially advised operators to shut down their servers while it investigated the unauthorized wallet withdrawal reports. BTCPay has not disclosed the number of affected operators, the value of stolen funds, or the technical details of how attackers accessed the wallets. It has asked affected users to submit information and logs to its security team for further investigation.
This incident follows a previous security issue in August 2026, when BTCPay restricted remote Lightning access due to a vulnerability that allowed attackers to obtain Lightning Network Daemon (LND) credentials and steal funds. It remains unclear whether the latest attack vector is connected to the August vulnerability.