Attackers drain Bitcoin and Litecoin hot wallets on outdated BTCPay Server instances
The project says the attacks hit versions 2.4.1 and earlier and urges operators to install version 2.4.7.
Evidence: Independent reports. Security stories run only with a named disclosure or independent reporting behind them.
The maintainer of BTCPay Server, an open-source payment processor that lets businesses accept cryptocurrency directly into their own wallets, is urging users to update after attackers drained hot wallets on instances running older versions, BleepingComputer reports. The Hacker News also reports thefts of Bitcoin and Litecoin through an exploited flaw. Operators were first told to shut their servers down while the unauthorized payments were investigated. Early Monday, the maintainer said it had identified an attack vector targeting instances running version 2.4.1, released July 23, 2026, or earlier, and recommended updating to version 2.4.7. BTCPay founder Nicolas Dorier said the attacks did not target public servers. The investigation focused on how the attacker was able to log in as an administrator on instances older than version 2.4.2. On October 29, the project had disclosed a critical vulnerability found with Anthropic's Frontier OSS scanner, and that disclosure led to the emergency release of version 2.4.7. Because BTCPay is self-hosted, each merchant has to apply the update. The incident shows how a delay in patching self-run payment infrastructure can lead directly to stolen funds.