BTCPay Server, the free, open-source payment processor used by thousands of merchants to accept Bitcoin without a middleman, says it has pinned down the attack vector behind a wave of reports in which attackers drained funds from operators' hot wallets.
In an update on Monday, the project said its investigation points to instances running version 2.4.1 or earlier — a release that dates back to 23 July 2026. Crucially, BTCPay said it has received no credible reports of hot wallet drains from anyone running the current release, version 2.4.7, and is urging every operator to update immediately.
From “Shut It Down” to a Diagnosis
The update follows an earlier, more drastic warning in which BTCPay told operators to take their server instances offline altogether while it investigated reports of unauthorised withdrawals, and published instructions for doing so. Shutting down a self-hosted payment server is a big ask for a merchant, so the fact that the team went there first gives a sense of how seriously it took the reports.
So far, the project has not said how many operators were hit, how much Bitcoin was taken, or exactly how the attackers got into the wallets. It has asked anyone affected to send details and server logs to its security team so it can finish the investigation.
Why Hot Wallets Are the Weak Spot
BTCPay lets merchants run in different modes. Many connect a watch-only wallet, where the server can generate addresses and track payments but never holds the private keys. Others enable a hot wallet, where the keys live on the server itself so it can send funds automatically — handy for refunds, payouts and Lightning, but it means anyone who compromises the server can potentially sign transactions and empty it. That trade-off is exactly what the latest attacks appear to have exploited.
The Third Scare in Three Months
This is not BTCPay's first rough patch this year. In August, the project shipped version 2.4.2 to fix a critical vulnerability it said was being actively exploited, crediting researchers from the Bitcoin Red Team effort for reporting it and advising integrators to also update NBXplorer, the blockchain indexer BTCPay relies on. Around the same time, an attack that abused a vulnerability to obtain Lightning Network Daemon (LND) credentials led BTCPay to restrict remote Lightning access. It remains unclear whether the new attack vector is linked to those earlier incidents.
The fix-it releases have kept coming since. Version 2.4.6, out on 26 October, brought broad security hardening around API permissions and untrusted input. Version 2.4.7, released on 29 October, went further, fixing 85 security findings — one rated critical, 13 high, 52 medium and 19 low — surfaced by an automated open-source code-scanning programme. The patches cover payouts, Lightning payment verification, two-factor authentication limits, API token checks and store-isolation issues on servers shared by multiple merchants.
What Operators Should Do Now
- Update to 2.4.7 straight away if you run BTCPay Server, and confirm the version in your server settings afterwards.
- Review your hot wallet — check recent outgoing transactions and keep only the balance you genuinely need on the server.
- Sweep funds to cold storage if you were running an older version, since keys on a compromised server should be treated as exposed.
- Send logs to BTCPay's security team if you spot unexplained withdrawals.
The Bigger Picture
None of this is a flaw in Bitcoin itself — the network and its rules are untouched. It is a reminder that self-hosting your own payment stack gives you sovereignty, but also makes you responsible for keeping it patched. For merchants, the safest setup remains the boring one: watch-only by default, a small hot wallet only where it is really needed, and updates applied the day they land.
02 November 2026
Country:
Global
Topic:
Security | Adoption