Founder Nicolas Dorier says public servers running version 2.4.7 were not attacked. Meanwhile, older vulnerabilities are under investigation.
ByChayanika Deka
BTCPay Server’s investigation has identified an attack vector targeting instances running version 2.4.1, released on July 23, 2026, or older, following reports of unauthorized attackers sweeping hot wallets.
The open-orts of hot wallet drains affecting users running the latest 2.4.7 release
Unauthorized Hot Wallet Sweeps
The team is urging everyone to keep their BTCPay Server instances updated and has asked impacted users to send all details and logs to security@btcpayserver.org. Earlier, the platform had urged users to shut down their instances until the investigation was complete. Its founder, Nicolas Dorier, confirmed,
“Update on my part: Our public servers were not attacked (on 2.4.7), it seems reports are before 2.4.2. The attacker managed to log in as admin on those instance, we are still trying to figure out how… We have traces that pre 2.4.2 vulnerabilities were used. We will communicate more in a following blog post.”
It has not disclosed how much was lost or how many servers were affected.
BTCPay Server is a free, self-hosted, open-nts to accept Bitcoin and Lightning Network payments without relying on third-party intermediaries. Payments go directly to connected wallets, with no subscription or transaction fees beyond standard network charges. The platform also includes tools for managing invoices, point-of-sale payments, crowdfunding campaigns, and tips
Previous Security Scares
The latest development comes around three months after BTCPay Server disclosed a vulnerability that was exploited to steal funds from some users. The flaw allowed attackers to obtain LND admin macaroon credentials from affected instances and use them to access connected LND wallets.
The incident also comes just days after the Binance hack, in which an exploiter drained more than $6 billion in crypto assets. The heist, described as the largest exploit in crypto history, has been attributed by the FBI and security analysts to TraderTraitor, a state-sponsored cyber warfare group linked to North Korea.
