BTCPay Server says its investigation into unauthorized hot wallet sweeps has identified an attack path affecting instances running version 2.4.1, released on July 23, 2026, or older. The open-source payment processor added that it has no credible reports of similar drains on the latest 2.4.7 release.

The team is now urging operators to keep their deployments updated and has asked users who believe they were affected to send full details and logs to security@btcpayserver.org. The company has not said how many servers were impacted or how much cryptocurrency may have been lost.

Investigation narrows the affected versions

The update follows earlier reports that attackers had been sweeping funds from some hot wallets connected to BTCPay Server instances. After initially telling users to shut down their servers while the review was underway, the project says its findings now point to older software versions as the common factor.

According to BTCPay Server, the identified attack vector targets deployments on version 2.4.1 or earlier. At the same time, the project said it has not received credible reports of hot wallet drains involving users on version 2.4.7.

Founder says attackers gained admin access

Founder Nicolas Dorier said the project’s own public servers were not attacked and were running version 2.4.7. In his account of the investigation so far, the reports appear to involve versions from before 2.4.2.

Dorier said traces indicate vulnerabilities that existed before 2.4.2 were used in the incident. He also said the attacker was able to log in as an administrator on affected instances, although the team was still working to determine exactly how that access was obtained.

Users asked to preserve evidence and update

BTCPay Server is asking all operators to update their instances and, where there are signs of compromise, provide logs and other relevant details to the project’s security contact. That request suggests the investigation is still active and that the team is trying to build a fuller picture of how the attacks unfolded across different setups.

The company’s public statements remain limited to confirmed findings. It has not disclosed a total loss figure, an exact victim count, or a detailed technical explanation of the exploit path.

What BTCPay Server does and what comes next

BTCPay Server is a free, self-hosted Bitcoin payment processor that lets merchants and individuals accept Bitcoin and Lightning Network payments without using a third-party intermediary. Payments are routed directly to connected wallets, and the software also includes tools for invoices, point-of-sale payments, crowdfunding campaigns, and tips.

For now, the next confirmed step is a further blog post from the project. Dorier said the team plans to communicate more once it has a clearer understanding of how the attacker gained administrator access on older instances.

Source: cryptopotato.com