BTCPay Server Reveals How Attackers Targeted Older Instances in Hot Wallet Incident

BTCPay Server’s investigation has identified an attack vector targeting instances running version 2.4.1, released on July 23, 2026, or older, following reports of unauthorized attackers sweeping hot wallets. The open-source cryptocurrency payment processor said it has no credible reports of hot wallet drains affecting users running the latest 2.4.7 release. The team is urging everyone to keep their BTCPay Server instances updated and has asked impacted users to send all details and logs to security@btcpayserver.org. Earlier, the platform had urged users to shut down their instances until the investigation was complete.