BTCPay Server Warns of Hot Wallet Thefts: Update to v2.4.7

BTCPay Server urged Bitcoin payment operators to update their installations after reports that unauthorized attackers withdrew funds from hot wallets. The project identified an attack vector affecting versions 2.4.1 and earlier, with the vulnerable release published on July 23, 2026.

The latest version, BTCPay Server 2.4.7, has not been linked to any credible reports of hot wallet drains. Operators were advised to upgrade to 2.4.7 and previously received instructions to shut down affected server instances while the security investigation was underway.

BTCPay has not disclosed how many operators were affected, how much was stolen or the technical details of the attack vector. The project asked affected users to provide information and server logs to its security team. Cointelegraph did not receive a response from BTCPay Server before publication.

The reports came less than three months after an August attack exploited a vulnerability to obtain Lightning Network Daemon credentials and steal funds. BTCPay subsequently restricted remote Lightning access, but it remains unclear whether the new hot wallet attack vector is connected to that earlier incident.