BTCPay Server warns of hot wallet drains on outdated instances

BTCPay Server, free open-source software that merchants self-host to accept Bitcoin payments, warned users that it was receiving reports of hot wallets on BTCPay servers being swept by unauthorized attackers. In an initial post, the project urged anyone running an instance to shut it down using the btcpay-down.sh script until the investigation was complete.

Following its investigation, BTCPay said it identified an attack vector targeting instances running version 2.4.1, released July 23, 2026, or older, and said it has no credible reports of hot wallet drains affecting users on the latest 2.4.7 release. It urged everyone to keep their BTCPay Server installations updated and asked affected users to send details and logs to its security email address. The project also thanked hosting provider LunaNode and others for automatically shutting down older, vulnerable instances after its initial announcement.

Founder Nicolas Dorier added that a fuller blog post with more detail is coming, but said users who have updated at least once since the release of version 2.4.2 have no reason to panic. He reiterated the advice to update often and not keep large amounts of funds in a hot wallet, where the private keys are stored directly on the server. BTCPay has not disclosed how many instances were affected, how much was stolen, or the exact technical details of how attackers got in.

Why it matters

Self-hosted crypto payment infrastructure is only as safe as its last update, and this incident is a reminder to patch promptly and limit hot wallet balances.

Source: BTCPay Server on X