BTCPay Server advises users to update after an attack vector is discovered affecting older versions.
Tech & Launches ·
BTCPay Server has identified an attack vector affecting instances running version 2.4.1 from July 23, 2026, or earlier, prompting the project to urge users to update. The latest 2.4.7 release has no credible reports of hot wallet drains associated with the vulnerability. Users still operating older versions are advised to upgrade immediately; those who believe they may be affected should contact security@btcpayserver.org with full details and logs.
Hosting providers including LunaNode have begun automatically shutting down instances running vulnerable versions to prevent exploitation. This coordinated response limits the window during which older deployments remain exposed, though the exact scope of affected instances and the technical nature of the attack vector have not been detailed publicly.
The incident underscores ongoing security risks in self-hosted payment infrastructure. Whether users running versions between 2.4.1 and 2.4.6 face the same exposure, and whether any funds have been lost before provider shutdowns took effect, remain unclear.