BTCPay Server Reveals How Attackers Targeted Older Instances in Hot Wallet Incident

Founder Nicolas Dorier says public servers running version 2.4.7 were not attacked. Meanwhile, older vulnerabilities are under investigation. BTCPay Server’s investigation has identified an attack vector targeting instances running version 2.4.1, released on July 23, 2026, or older, following reports of unauthorized attackers sweeping hot wallets. The open-source cryptocurrency payment processor said it has no credible reports of hot wallet drains affecting users running the latest 2.4.7 release. Unauthorized Hot Wallet Sweeps The team is urging everyone to keep their BTCPay Server instances updated and has asked impacted users to send all details and logs to security@btcpayserver.org. Earlier, the platform had urged users to shut down their instances until the investigation was complete. Its founder, Nicolas Dorier, confirmed, “Update on my part: Our public servers were not attacked (on 2.4.7), it seems reports are before 2.4.2. The attacker managed to log in as admin on those instance, we are still trying to figure out how… We have traces that pre 2.4.2 vulnerabilities were used. We will communicate more in a following blog post.” It has not disclosed how much was lost or how man...