BTCPay Server’s ongoing probe into unauthorized hot-wallet withdrawals has tracked the security breaches to installations running version 2.4.1 (released July 23, 2026) or earlier. As of Nov. 2, the project confirmed there had been no credible drain reports for version 2.4.7, prompting software update calls across the user base. This BTCPay Server hot-wallet drain primarily impacted administrators whose servers suffered a compromise.
The security advisory followed an initial warning issued late Nov. 1, which instructed operators to shut down their instances immediately without providing specific technical details. A subsequent update narrowed the focus to older software releases, though it did not assert that every outdated instance had been successfully attacked.
BTCPay Server Hot-Wallet Drain Linked to Older Software Versions
What the investigation identified
Intruders successfully secured administrator access to outdated servers and emptied the attached hot wallets. Founder Nicolas Dorier verified that attackers logged in with administrative privileges, though the development team was still investigating how those credentials were acquired.
Version 2.4.7 remains an outlier in the incident reports, with the project receiving zero credible theft reports from users on that version. Operators should view this status as the project’s current record rather than an absolute guarantee that the version is immune to future vulnerabilities.
How the warning unfolded
The shutdown alert on Nov. 1 lacked specifics. By Nov. 2, the project pinpointed version 2.4.1 and older as the vulnerable range, renewed software update directives, and requested that impacted users share server logs with the security team. According to Cointelegraph, BTCPay also circulated explicit shutdown instructions.
For administrators who tracked both notices, the second update carried much greater weight because it identified the exact software parameters and cited 2.4.7 as the current release. The investigation remains ongoing.
BTCPay Server, Nicolas Dorier and Hosting Providers
BTCPay Server functions as a free, open-source payment processor that merchants self-host to accept Bitcoin directly. The exploit targets individual server installations and hot wallets rather than any centralized BTCPay user account directory.
While Dorier confirmed unauthorized administrator access on impacted servers, the exact intrusion vector remains unknown. Dorier himself operates version 2.4.7 equipped with a hot wallet, yet he cautioned users never to store more funds on a server than they are willing to lose.
Hosting providers took automated steps to shutter customer instances running older releases. BeInCrypto reported that platforms like LunaNode executed automated shutdowns. While these outages disrupt merchant payment processing, they effectively block attackers while administrators address the vulnerability.
How the July Release and August Patch Set the Context
Version 2.4.1 and the earlier flaw
Version 2.4.1 debuted on July 23, 2026. A previously uncovered critical vulnerability in that version allowed remote bad actors to steal Lightning node credentials and drain connected wallets. Version 2.4.2 arrived in August to patch that specific bug, though attackers had already begun exploiting it beforehand.
Both security events resulted in stolen hot-wallet funds, but available reports do not explicitly connect the current wave of attacks to the August vulnerability.
Why the two incidents are being compared
BeInCrypto characterized this event as at least the second theft cycle within three months to target BTCPay Server environments older than version 2.4.2. Whether the current attack vector shares roots with the August flaw remains unverified. The clear common denominator is unpatched self-hosted infrastructure rather than a confirmed shared exploit. Operators are advised to follow official version recommendations instead of assuming the incidents share a single technical cause.
What the Versions and Timeline Mean for Operators
The version threshold is clearly defined: the project’s investigation targets version 2.4.1 and older, while version 2.4.7 has no credible drain reports associated with it. Version 2.4.1 launched on July 23, followed by the version 2.4.2 security patch in August.
For any operator, the primary concern is whether their server runs an outdated release and maintains a hot wallet. Affected administrators face severe exposure because admin-level access grants intruders the ability to sweep funds stored locally. Upgrading software resolves the project’s primary version concern, even as investigations into service restoration continue.
These version numbers underscore a broader truth: self-hosted payment infrastructure demands rigorous software maintenance. BeInCrypto pointed out that Core Lightning recently issued similar alerts regarding attacks on unpatched nodes. That parallel highlights systemic risks from neglected installations rather than proof that both platforms face the same attacker or exploit.
Hot Wallets Put Server-Resident Funds at Risk
A hot wallet maintains private keys directly on the server, enabling outgoing transactions without requiring individual operator sign-offs. Because of this convenience, an intruder with administrative privileges can easily siphon away stored coins. BeInCrypto highlighted the direct danger: operators running vulnerable legacy instances alongside hot wallets face maximum exposure.
Dorier recommended keeping strictly limited funds—amounts one is fully prepared to lose—inside hot wallets, warning that the development team cannot guarantee total prevention in the future. His remarks addressed server-based fund management rather than claiming every BTCPay deployment or hot wallet has been compromised.
Reports have not disclosed the total financial losses or the exact count of affected administrators. However, operators do not require these metrics to take defensive action, as the project has clearly identified older releases and urged immediate updates.
What the Investigation Has Told Operators to Do
BTCPay Server initially instructed operators to take their instances offline during the early investigative phase. Subsequent guidance urged continuous software updates and flagged version 2.4.1 and older as the core targets. Affected users were further directed to submit logs to the core security team.
Remediation centers entirely around vulnerable installations and ongoing project updates. Current coverage includes no set deadline for a final technical report or a timeline for future software drops. Operators should adhere strictly to instructions released by the project rather than assuming an instance is secure simply because it has not yet displayed signs of asset drainage.
Incident Details and Remaining Exposure
According to BeInCrypto, the development team has identified an active attack vector alongside vulnerability traces that predate version 2.4.2. The exact mechanism granting attackers administrator privileges remains undetermined, leaving any direct link to the August flaw unresolved.
These technical distinctions matter because an attacker’s entry path determines precisely which systems remain vulnerable and what remediation steps are required. For now, safety guidelines align strictly with the project’s stated version ranges while investigations proceed. Disclosures regarding the total number of impacted users or the total value of stolen assets remain withheld.
Operators must differentiate between general reported incidents and confirmed losses on their personal servers. While submitting logs aids the security team’s ongoing investigation, doing so does not replace the immediate necessity of applying version upgrades and shutdown protocols.
What Comes Next for BTCPay Server Operators
Next steps rely on findings from the development team and subsequent security instructions. While the project has evolved its messaging from a broad shutdown notice to a precise version alert, available reports cite no definitive date for a comprehensive technical breakdown.
Operators should closely monitor project communications, maintain up-to-date software deployments, and avoid viewing the lack of reported drains on version 2.4.7 as a permanent immunity guarantee. Users managing legacy installations paired with hot wallets bear the highest urgency to act on warnings and supply logs if compromised.
Forcing a server offline will disrupt active payment processing, yet leaving vulnerable software online risks total loss of server-resident funds. The project’s directives prioritize security investigations and asset protection above uninterrupted uptime until users can successfully complete required updates.
FAQ
When did BTCPay Server first warn operators?
The project issued its initial shutdown notice late on Nov. 1, 2026. A follow-up advisory on Nov. 2 identified version 2.4.1 and older as the targeted range and urged immediate updates.
Does the investigation link the current incident to the August flaw?
Current reports characterize the connection as unresolved. The August flaw involved Lightning node credentials and was patched in version 2.4.2, whereas the active investigation focuses on a vector targeting version 2.4.1 and older.
Why are hot wallets exposed when a server is compromised?
Hot wallets store their private keys directly on the server, permitting outgoing transactions without requiring a separate operator signature. BeInCrypto noted that administrative access to an impacted server allows bad actors to easily transfer these coins.
What should affected operators send to BTCPay Server?
According to Cointelegraph, the project asked affected users to submit diagnostic data and logs directly to its security team to assist with the ongoing investigation.
Could a server shutdown interrupt merchant payments?
Yes. BTCPay Server asked operators to take instances offline during the initial response phase, and certain hosting providers automatically shut down older customer instances. This can disrupt merchant payment processing while administrators address the security warnings.
This article is for information only and is not financial advice.
