Attack on Older BTCPay Versions Drains Hot Wallets
Operators on version 2.4.1 and earlier are urged to install 2.4.7 and take servers offline during the investigation.
Updated on Nov. 2, 2026 in Cybersecurity
Live Poll
Would you trust a payment system you host yourself to keep your funds safe?
BTCPay Server has identified an attack targeting older versions of its open-source Bitcoin payment software, with reports indicating thieves emptied merchants' Bitcoin hot wallets. The findings are research-stage in the sense that the investigation is ongoing and no loss figure has been published.
Why it matters
The attack shows how a single compromised administrator login on a payment server can translate directly into the loss of funds held in a merchant's online wallet. It arrives as merchants and operators of self-hosted payment infrastructure are being asked to keep pace with security patches for software they run themselves.
The latest release, version 2.4.7, became available on Oct. 29 and fixed 85 security findings, including one critical and 13 high-rated issues. The project has not disclosed a loss total or the number of servers affected, and the full scope of the withdrawals remains under investigation.
The players
BTCPay Server
An open-source, self-hosted Bitcoin payment processing platform that lets merchants accept Bitcoin directly without a third-party processor.
The details
BTCPay Server is software that lets merchants accept Bitcoin payments on servers they control, and a hot wallet is a Bitcoin wallet kept connected to the internet so it can send transfers on demand. In the reported attack, an intruder logged into affected servers as an administrator. The server stores the wallet seed, the secret value from which all of a wallet's keys are derived, and uses it to authorize outgoing transfers without a separate signing device. That design means an administrator-level login is enough to move funds out of the wallet.
Timeline
Version 2.4.1 was released July 23, and it is among the affected versions.
A wallet-theft incident in August exposed credentials for Lightning payment nodes, a separate earlier event.
Version 2.4.7 became available Oct. 29 with fixes for 85 security findings.
On Nov. 1, the team asked operators to take their servers offline during an investigation of unauthorized withdrawals.
The attack on older versions was publicly identified on Nov. 2.
The Tech Race
The episode places BTCPay in a wider contest among self-hosted and custodial Bitcoin payment tools over how securely hot-wallet keys can be managed on servers that operators run themselves. Because the wallet seed sits on the same machine that handles payments, the project's security posture depends on patch adoption across many independent operators.
Merchants and operators running BTCPay Server on versions 2.4.1 or earlier should install version 2.4.7 and take affected servers offline as the team has instructed, since the attack targets administrator access on older builds. Operators who cannot confirm their version should treat their hot wallet as at risk until the update is verified.
The takeaway
Operators should check their installed BTCPay version against 2.4.7 and confirm the update before bringing servers back online. The project's next disclosure on the investigation, including any loss figure or count of compromised servers, is the milestone to watch.
Further reading
For more on how attacks like this unfold across connected systems, browse our Cybersecurity coverage.
Source note: This article includes information reported by Coininsider.
Live Poll
Would you trust a payment system you host yourself to keep your funds safe?
