BTCPay Server warns of hot wallet thefts targeting outdated software

hot wallet thefts — BTCPay Server has urged operators to shut down and update their payment servers after identifying an attack vector that has drained funds from hot wallets running outdated software.

The Bitcoin payment platform said on Monday its investigation found the vulnerability targets instances running version 2.4.1 or earlier, released in July 2026. The project stated it has received no credible reports of thefts from users running the latest release, version 2.4.7.

BTCPay Server has not disclosed the number of affected operators, the total value of stolen funds, or technical details of the exploit. It has asked affected users to submit information and logs to its security team.

The warning follows an incident three months ago when BTCPay restricted remote Lightning access after an August attack exploited a vulnerability to steal LND credentials. It remains unclear if the latest attack is connected.