BTCPay Server warns of hot wallet thefts on instances running 2.4.1 or earlier
Operators on older builds face drained wallets, and the project says version 2.4.7 has no credible drain reports.
BTCPay Server, an open-source self-hosted crypto payment processor, has told operators to upgrade to version 2.4.7 after attackers drained hot wallets on instances running 2.4.1 or earlier. The project's incident response traced the attacks to a vector affecting those older builds, and reports of drains began around November 1, 2026. Operators running 2.4.1 or older are advised to take their servers offline, and anyone with suspected theft should treat the whole machine and its stored secrets as compromised and rebuild on a fresh server with a new wallet. The project has said it has no credible reports of drains on 2.4.7, which patches a critical flaw and several medium-severity ones, but it has not yet named the vulnerability used in the current attacks.
Why it matters
Self-hosted merchants who run BTCPay Server without upgrading are the ones exposed, and a drained hot wallet can mean lost funds that a server upgrade alone does not recover. The project's guidance is to treat any suspected theft as a full compromise and rebuild, which means the affected operators must rotate their wallets and secrets rather than only patching. The project has not yet named the vulnerability behind the current attacks, so users cannot yet confirm from public detail exactly which weakness was exploited.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.