BTCPay Server has identified a security vulnerability affecting older versions of its payment software. The platform reported that attackers are targeting instances running version 2.4.1 or earlier, which was released on July 23, 2026, to drain funds from hot wallets.
The project team has urged all operators to update their installations to version 2.4.7, noting that no reports of fund theft have been linked to this latest release. Previously, the platform advised users to shut down their server instances while the investigation was underway.
BTCPay Server has not disclosed the total number of affected operators or the specific value of the stolen assets. The company is currently requesting that affected users submit relevant logs and information to its security team for further analysis.
This incident follows a security event from August, when the platform restricted remote Lightning access after a vulnerability was exploited to steal funds via Lightning Network Daemon credentials. It is not yet confirmed if the two incidents are related.
