BTCPay Server’s investigation has identified an attack vector targeting instances running version 2.4.1, released on July 23, 2026, or older, following reports of unauthorized attackers sweeping hot wallets.

The open-source cryptocurrency payment processor said it has no credible reports of hot wallet drains affecting users running the latest 2.4.7 release.

Unauthorized Hot Wallet Sweeps

The team is urging everyone to keep their BTCPay Server instances updated and has asked impacted users to send all details and logs to security@btcpayserver.org. Earlier, the platform had urged users to shut down their instances until the investigation was complete. Its founder, Nicolas Dorier, confirmed,

“Update on my part: Our public servers were not attacked (on 2.4.7), it seems reports are before 2.4.2. The attacker managed to log in as admin on those instance, we are still trying to figure out how… We have traces that pre 2.4.2 vulnerabilities were used. We will communicate more in a following blog post.”

It has not disclosed how much was lost or how many servers were affected.

BTCPay Server is a free, self-hosted, open-source Bitcoin payment processor that allows individuals and merchants to accept Bitcoin and Lightning Network payments without relying on third-party intermediaries. Payments go directly to connected wallets, with no subscription or transaction fees beyond standard network charges. The platform also includes tools for managing invoices, point-of-sale payments, crowdfunding campaigns, and tips.

Previous Security Scares

The latest development comes around three months after BTCPay Server disclosed a vulnerability that was exploited to steal funds from some users. The flaw allowed attackers to obtain LND admin macaroon credentials from affected instances and use them to access connected LND wallets.

The incident also comes just days after the Binance hack, in which an exploiter drained more than $6 billion in crypto assets. The heist, described as the largest exploit in crypto history, has been attributed by the FBI and security analysts to TraderTraitor, a state-sponsored cyber warfare group linked to North Korea.

The post BTCPay Server Reveals How Attackers Targeted Older Instances in Hot Wallet Incident appeared first on CryptoPotato.