BTCPay Server links hot wallet thefts to attack vector in older software versions
Hot wallets drained on servers running older BTCPay versions
BTCPay Server, an open-source tool that lets merchants accept Bitcoin payments, says it has identified how attackers drained funds from users' hot wallets. A hot wallet is a crypto wallet that stays connected to the internet.
The project said on Monday that its investigation found an attack vector — a specific way in for attackers — targeting servers running version 2.4.1 or earlier of its software. That version was released on July 23, 2026.
BTCPay said it had received no credible reports of wallet drains from users running its latest release, version 2.4.7, and urged operators to update their installations.
Key details
- The attack vector affects BTCPay Server versions 2.4.1 and earlier.
- No credible theft reports have come in for version 2.4.7, the latest release.
- Before identifying the cause, BTCPay told operators to shut down their servers while it investigated.
- The number of affected operators and the value of stolen funds have not been disclosed.
- The incident follows an August attack in which hackers stole Lightning Network credentials.
What BTCPay has told operators
Before announcing its findings, BTCPay warned operators to shut down their server instances while it looked into reports of unauthorized wallet withdrawals. It also shared instructions on how to take servers offline.
The project has not revealed how many operators were affected, how much money was stolen, or the technical details of how attackers reached the wallets. It asked affected users to send information and logs to its security team.
Cointelegraph said it contacted BTCPay Server for comment but did not receive a response before publication.
A second security incident in under three months
The theft reports come less than three months after BTCPay restricted remote access to the Lightning Network, a system built on top of Bitcoin for faster payments. That step followed an August attack in which hackers exploited a vulnerability to obtain Lightning Network Daemon (LND) credentials — the login details for the software that processes Lightning payments — and used them to steal funds.
It remains unclear whether the newly identified attack vector is connected to the August vulnerability.
What is known and what is still unclear
Confirmed so far: the attack vector targets versions 2.4.1 and earlier, the project has no credible reports of drains on version 2.4.7, and operators have been told to update.
Still unknown: how many servers were hit, the total value of stolen funds, the exact method attackers used, and whether this incident is linked to the earlier Lightning attack.
Sources for this report
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.