BTCPay Server maintainer warns of hot wallet thefts on outdated instances
The maintainer of BTCPay Server says attackers have been draining hot wallets on instances running older versions.
Written by a model from the sources below. Verify against them.
- Vendor
- BTCPay Server
- Product
- BTCPay Server
- Status
- Confirmed
- Disclosed
Summary
The maintainer has urged users to install the latest release, and the item does not give the number of affected instances or the amounts stolen.
What to do
Update BTCPay Server to the latest version.
Check hot wallet balances and transaction history for unauthorized transfers.
Move remaining funds to a new wallet if the instance is still on an older version.
Rotate API keys and credentials for the server.
Timeline
- Made public by BleepingComputer
- First seen by cve.now
- Confirmed by BTCPay Server
BleepingComputer: ““Our incident response investigation identified an attack vector targeting instances running versions 2.4.1 (Jul 23, 2026) or older,” BTCPay Server says .”
Evidence 3
- SocialMastodon
“BTCPay Server hot wallets are being drained.”
- PressBleepingComputer
“The maintainer of BTCPay Server, an open-source cryptocurrency payment processor, has urged users to install the latest version as hackers have been draining "hot wallets" on instances running older versions.”
+1 more: BleepingComputer on Bluesky - SocialBluesky
“Attackers Exploit Older BTCPay Server Versions to Steal Cryptocurrency”
Corrections
- Removed “The attackers got in by exploiting a vulnerability”: its source no longer supports it.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about the BTCPay Server breach
Was BTCPay Server breached?
Yes. BTCPay Server says so: ““Our incident response investigation identified an attack vector targeting instances running versions 2.4.1 (Jul 23, 2026) or older,” BTCPay Server says .” (BleepingComputer).
What should BTCPay Server customers do?
Update BTCPay Server to the latest version. Check hot wallet balances and transaction history for unauthorized transfers. Move remaining funds to a new wallet if the instance is still on an older version. Rotate API keys and credentials for the server.