BTCPay Server Vulnerability Exposes Hot Wallets on Outdated Software

Bitcoin payment processor BTCPay Server has alerted its operator community about a critical vulnerability affecting older versions of its platform, revealing that attackers have successfully exploited the flaw to drain cryptocurrency from user-operated hot wallets. The company has issued urgent guidance for affected parties to upgrade their systems without delay.

After receiving initial reports of unauthorized fund withdrawals, BTCPay Server completed an investigation that identified the vulnerability as affecting installations running version 2.4.1 or any earlier release. That particular version was initially rolled out in July 2026. The company has recommended that all operators immediately upgrade to version 2.4.7, its current stable release, which incorporates the necessary security fixes.

Limited Disclosure and Ongoing Investigation

BTCPay Server has emphasized that operators who had already deployed the latest software version have not reported credible instances of compromised hot wallets. The company first instructed operators to take their servers offline while conducting its security investigation, and subsequently released detailed instructions for safely executing this shutdown procedure. However, BTCPay Server has chosen not to disclose several critical details about the breach, including the specific attack vector, technical vulnerability details, or the mechanism by which attackers gained unauthorized access to the stored cryptocurrency.

The company has not revealed how many operator installations were affected by the vulnerability, nor has it disclosed the total value of cryptocurrency that was stolen. Instead, BTCPay Server is requesting that users who experienced unauthorized withdrawals submit their server logs and detailed incident information to the company’s security team.

Connected to Earlier Security Incidents

This vulnerability discovery arrives approximately three months after BTCPay Server faced another significant security incident in August 2026. That earlier attack exploited a separate vulnerability to compromise Lightning Network Daemon (LND) credentials, enabling attackers to access and steal funds through the Lightning Network integration. Following that incident, BTCPay Server implemented restrictions on remote Lightning access to prevent similar exploitation.

The relationship between the current vulnerability and the August incident remains unclear. BTCPay Server has not publicly confirmed whether the two attacks are connected or whether they represent independent threat actors opportunistically targeting different vulnerabilities within the platform’s ecosystem.

Why This Matters

The incident reinforces a fundamental principle in cryptocurrency infrastructure security: operators managing user funds must maintain current software versions and promptly apply security patches. For merchants and services relying on BTCPay Server as their payment processing backbone, this situation demonstrates that outdated software versions can expose operational assets to determined attackers capable of accessing hot wallets. Security vulnerabilities in crypto payment infrastructure undermine confidence in the broader cryptocurrency ecosystem.

Source: BTCPay Server, via Cointelegraph. Not financial advice.