BTCPay advises merchants to shut down servers following active hot wallet attacks targeting versions 2.4.1 and older.
Security & Exploits ·
BTCPay Server, the open-source Bitcoin payment tool, instructed operators to disable their instances following reports of unauthorized draining of connected hot wallets. The project identified the compromise as targeting version 2.4.1 and earlier releases, with attackers gaining administrator-level access to affected systems. BTCPay said it had received no credible accounts of fund loss from users on the current 2.4.7 version.
The incident emerged days after BTCPay shipped an emergency patch on Thursday addressing one critical and multiple medium-severity flaws discovered through Anthropic's open-source software scanner. The project has not disclosed whether the active attacks exploited any of those specific vulnerabilities. Some hosting providers, including LunaNode, automatically shut down older BTCPay instances to prevent further exploitation.
The full scope of the compromise remains unclear. BTCPay has not stated how many servers were affected or quantified the total Bitcoin extracted. The incident marks the second major security incident for the project in 2026, following an August warning about a critical flaw in versions prior to 2.4.2 that was also being actively exploited at the time.