BTCPay Server has warned that attackers have used a newly identified attack vector to drain funds from hot wallets connected to older installations of its self-hosted Bitcoin payment software, prompting the project to urge affected operators to shut down their servers and upgrade immediately.
The warning applies to BTCPay Server version 2.4.1 and earlier, according to an update published by the project on Monday. Version 2.4.1 was released on July 23, 2026. BTCPay said it had received reports of unauthorized wallet withdrawals from affected setups, though it did not disclose the number of merchants involved or the amount of Bitcoin lost.
The project said it had not received credible reports of hot-wallet drains affecting users on version 2.4.7. Operators running older versions were told to move to the latest available release after taking their affected instances offline.
BTCPay had issued an earlier alert asking operators to shut down their servers while its team investigated reports of stolen funds. The project also published instructions for safely stopping instances, a precaution aimed at limiting further withdrawals from wallets that remain connected to vulnerable servers.
Hot wallets were the exposed target
The reported thefts involved hot wallets, which store private keys on systems connected to the internet so merchants can process payments, refunds, or Lightning-related transactions without manually signing each transfer. That convenience also gives an attacker a target if they gain control of the machine or the application managing the wallet.
BTCPay Server is designed as software that merchants can run on their own infrastructure rather than through a centralized payment company. The model gives businesses control over their funds and payment data, but it also places server maintenance, credential security, backups, and incident response with each operator.
In the latest case, the project said the attack vector had been used to access linked hot-wallet funds on vulnerable installations. BTCPay has not yet published a technical explanation of the vulnerability, the method used to enter affected systems, or whether attackers required stolen credentials, an exposed administrative interface, or another route into the server.
The absence of technical detail leaves operators with a practical priority: systems that stayed online while running version 2.4.1 or earlier should be treated as potentially exposed until administrators review them and complete the upgrade process.
BTCPay asked affected users to send logs and relevant information to its security team. Server logs can help identify unusual administrative sessions, unexpected wallet activity, or access attempts that preceded unauthorized withdrawals.
Recent incidents have raised pressure on operators
The new warning follows a separate security response less than three months after BTCPay restricted remote Lightning access following an August attack. That earlier incident involved a vulnerability through which attackers obtained credentials for Lightning Network Daemon, or LND, software and stole funds.
LND is one implementation used to operate a Lightning node, allowing Bitcoin payments to move through the Lightning Network. Credentials associated with an LND node can carry significant authority, depending on the setup, including the ability to access or move funds.
BTCPay has not established a connection between the August incident and the latest attack reports. The project has not released technical evidence indicating that the same flaw, intrusion method, or attackers were involved.
That distinction matters for operators assessing their exposure. A merchant who addressed the earlier remote-Lightning restriction may still need to check whether their BTCPay Server version falls within the newly affected range. Security fixes often address a specific weakness, while older software can retain other vulnerabilities discovered later.
The project development team released a wider security update on October 29 that addressed 85 software flaws, according to the supplied information. That release included one issue classified as critical and 13 classified as high risk. BTCPay warning about version 2.4.1 or earlier places the current response within a short period of intensive security maintenance for the payment stack.
Administrative access can turn a software flaw into a wallet loss
The attack reports underline the risk of keeping substantial balances in wallets attached to internet-facing payment infrastructure. A hot wallet can be useful for day-to-day operations, especially when a merchant needs to process automatic refunds or handle regular Lightning liquidity. It is a poor place to hold funds that do not need to be immediately available.
Once an attacker gains high-level access to a payment server, ordinary wallet safeguards may offer limited protection. The supplied account of the incident said the attackers obtained control of administrator accounts, giving them a direct route to systems linked to wallet funds and allowing them to bypass normal checks.
Operators should therefore review not only the BTCPay software version but also the credentials and infrastructure surrounding it. Passwords for server administration panels, hosting accounts, payment pages, remote-access tools, and Lightning services may need to be changed if a system could have been compromised. Existing access tokens, application keys, and recovery credentials also warrant review under an incident-response plan.
Administrators examining potentially affected installations should look for unfamiliar logins, new administrator accounts, unexpected configuration changes, unusual outbound connections, and wallet withdrawals that do not correspond with business activity. A server showing suspicious remote access may require a clean rebuild rather than a simple software update, particularly if an attacker could have viewed private keys or altered the environment.
Keeping only operational balances in a hot wallet would reduce the amount exposed in an intrusion. Funds not needed for routine payments can be held in offline or otherwise more tightly controlled storage, separating a merchant working liquidity from longer-term reserves.
BTCPay immediate guidance remains straightforward: operators using version 2.4.1 or earlier should shut down affected instances, update to the current release, and contact the project security team if they identify unauthorized withdrawals or evidence of compromise.
Concerned about hot wallet risks? Learn crucial protection steps in our guide: secure your crypto storage today.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
