BTCPay Users Urged to Update Software After Theft
Attackers targeting older BTCPay Server versions emptied merchants' Bitcoin hot wallets, prompting an urgent update call.
Updated on Nov. 2, 2026 in Cybersecurity
Live Poll
Would you trust a payment system you host yourself to keep your funds safe?
BTCPay Server has identified an attack against older versions of its software that reportedly emptied merchants' Bitcoin hot wallets. The project is urging operators to install its latest release, version 2.4.7, and take affected servers offline during the investigation.
Why it matters
Because the server stores the wallet seed and uses it to authorize outgoing Bitcoin transfers without a separate signing device, an attacker who gains administrator access can move funds directly. The incident highlights the security risk of running outdated payment software that holds live cryptocurrency balances.
The advisory relies on version records showing 2.4.7 became available Oct. 29 and fixed 85 findings, with 1 critical and 13 high-rated, compared with affected versions 2.4.1 and earlier. Neither a total loss amount nor the number of compromised servers has been disclosed.
The players
BTCPay Server
BTCPay Server is an open-source, self-hosted payment processor that lets merchants accept Bitcoin and Lightning payments without a third-party custodian.
The details
An attacker logged into affected servers as an administrator and emptied hot wallets holding Bitcoin. On Nov. 1 the team asked operators to take their servers offline while investigating unauthorized withdrawals.
Timeline
July 23: Version 2.4.1, one of the affected versions, was released.
August: A wallet-theft incident exposed credentials for Lightning payment nodes.
Oct. 29: Version 2.4.7 became available, fixing 85 security findings.
Nov. 1: Operators were asked to take servers offline during the investigation.
Nov. 2: The attack on older versions was publicly identified.
Big Picture
This attack follows BTCPay's August wallet-theft incident, which exposed credentials for Lightning payment nodes. Together the two events show repeated risk in self-hosted Bitcoin payment software that holds live funds.
Operators running BTCPay Server should check their version and install 2.4.7 immediately. If a server was running an affected version, it should be taken offline and reviewed for unauthorized withdrawals before resuming operation.
The takeaway
Keeping self-hosted payment software on the latest release is essential when it controls live cryptocurrency balances. Regularly reviewing administrator access and wallet activity can reveal unauthorized withdrawals early.
Further reading
Explore more stories in Cybersecurity.
Source note: This article includes information reported by Coininsider.
Live Poll
Would you trust a payment system you host yourself to keep your funds safe?
