BTCPay Server vulnerability in versions 2.4.1 and older enables hot wallet theft; latest 2.4.7 release unaffected.
Security & Exploits ·
BTCPay Server identified a vulnerability affecting instances running version 2.4.1 or older that allowed attackers to drain hot wallets by gaining unauthorized admin access. On November 1, 2026, the project reported that multiple instances had been compromised and urged operators to shut down their servers immediately using the ./btcpay-down.sh script pending investigation completion. Analysis suggests attackers exploited pre-2.4.2 vulnerabilities to log in as administrator, gaining access to private keys stored on affected servers.
The latest 2.4.7 release, deployed October 29, 2026, has received no credible reports of hot wallet drains and addressed 85 security findings. The project's own public servers, which run version 2.4.7, were not attacked. An earlier vulnerability discovered in August 2026 affected versions prior to 2.4.2 and enabled remote credential theft for connected Lightning nodes, though on-chain hot wallets were not compromised in that incident.
One analysis tracked approximately 18.46 BTC—valued near $1.44 million—consolidated at a single address from the sweeps. The precise mechanics of how attackers obtained initial admin credentials remain under investigation. Affected operators were asked to contact security@btcpayserver.org with details and logs, with a detailed post-incident report promised from the BTCPay Server team.