BTCPay’s old software is leaving hot wallets open to a $BTC heist 🚨

BTCPay Server has identified an attack vector affecting versions 2.4.1 or earlier of its Bitcoin payment software, following reports of attackers draining funds from users’ hot wallets. Version 2.4.1 was released July 23, 2026.

The project said Monday it had received no credible reports of hot wallet drains among users running its latest release, version 2.4.7, and urged operators to update their installations. BTCPay had previously urged operators to shut down server instances while it investigated unauthorized wallet withdrawals and shared instructions for doing so.

BTCPay has not disclosed the number of affected operators, the value of stolen funds or technical details about how attackers accessed the wallets. The project asked affected users to submit information and logs to its security team. Cointelegraph reached out to BTCPay Server for comment but did not receive a response before publication.

The reports came less than three months after BTCPay restricted remote Lightning access following an August attack that exploited a vulnerability to obtain Lightning Network Daemon (LND) credentials and steal funds. It remains unclear whether the newly identified attack vector is connected to the August vulnerability.