BTCPay Server Reports Hot-Wallet Theft Attacks on Outdated Instances
Summary
BTCPay Server says attackers targeted instances running version 2.4.1 or earlier, logging in as administrators and draining hot wallets. The project urges affected operators to take instances offline and update to 2.4.7.
Key points
- BTCPay Server reported hot-wallet thefts involving Bitcoin and Litecoin on instances running version 2.4.1 or earlier.
- The project said its investigation identified an attack vector involving unauthorized administrator access; the method was not detailed.
- BTCPay Server said it had no credible reports of hot-wallet drains on version 2.4.7.
- The project asked VPS providers to take affected instances offline and urged operators running version 2.4.1 or earlier to do the same.
- Operators are advised to update to version 2.4.7 through the server maintenance settings or the documented Docker update process.
- The project continues to receive incident reports and is responding to affected users.
Article Details
- Victim Organization
- BTCPay Server
- Incident Type
- Hot-wallet cryptocurrency theft following attacks on BTCPay Server instances running version 2.4.1 or earlier; the investigation identified an attack vector involving administrator access.
- Incident Date
- 2026-11-01
- Disclosure Date
- 2026-11-02
- Affected Records
- Unknown
- Affected Data Size
- Unknown
- Operational Impact
- Bitcoin and Litecoin were stolen from some hot wallets. BTCPay Server asked VPS hosting providers to take affected instances offline as a precaution, and urged operators of vulnerable versions to update or take their instances offline.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed