BTCPay Server's maintainers are pushing users to adopt the newest release after threat actors have successfully stolen funds from "hot wallets" on systems with outdated code. Administrators were initially told to take their servers offline while the team investigated the unauthorized fund transfers.
BTCPay Server functions as a self-hosted payment processing platform, enabling merchants to receive Bitcoin and other cryptocurrencies directly into their own wallets without relying on third-party intermediaries or incurring platform fees. The system manages invoice generation, payment validation, and transactions processed through the Lightning Network.
Early Monday, the maintainer announced it had "identified an attack vector targeting instances running version 2.4.1 (July 23, 2026) or earlier" and strongly recommended upgrading to version 2.4.7. Founder Nicolas Dorier clarified that the attacks were not aimed at publicly hosted servers, with the investigation centering on how attackers gained administrative access to systems running versions prior to 2.4.2.
On October 29, the project disclosed a critical vulnerability uncovered through Anthropic's Frontier OSS scanner, leading to the emergency release of version 2.4.7. Dorier noted that evidence suggested the attacker exploited flaws present in BTCPay Server versions before 2.4.2, a finding the project later confirmed.
Our incident response investigation identified an attack vector targeting instances running versions 2.4.1 (Jul 23, 2026) or older. We have no credible reports of hot wallet drains for users running the latest 2.4.7 release. We again urge everyone to keep their BTCPay Server updated.
BTCPay Server
Affected operators should forward all relevant information and server logs to security@btcpayserver.org. In August, when BTCPay Server released version 2.4.2, it warned of an actively exploited vulnerability that exposed LND credential files, potentially allowing attackers to compromise Lightning nodes and access funds. The project has not yet detailed which specific flaw is being exploited in the current campaign.
Update instructions
Users should upgrade to version 2.4.7 through Server Settings → Maintenance → Update. For Docker deployments, administrators can apply the patch by connecting via SSH, executing sudo su -, navigating to the deployment directory with cd btcpayserver-docker, and running ./btcpay-update.sh. Instances running 2.4.1 or earlier should be taken offline immediately.