BTCPay Server Reveals How Attackers Targeted Older Instances in Hot Wallet Incident

BTCPay Server’s investigation has identified an attack vector targeting instances running version 2.4.1, released on July 23, 2026, or older, following reports of unauthorized attackers sweeping hot wallets. The open-source cryptocurrency payment processor said it has no credible reports of hot wallet drains affecting users running the latest 2.4.7 release. Unauthorized Hot Wallet Sweeps The team is urging everyone to keep their BTCPay Server instances updated and has asked impacted users to send all details and logs to security@btcpayserver.org. Earlier, the platform had urged users to shut down their instances until the investigation was complete. Its founder, Nicolas Dorier, confirmed, “Update on my part: Our public servers were not attacked (on 2.4.7), it seems reports are before 2.4.2.

BeCrypto News shows a short excerpt and links to the publisher. The full report belongs to CryptoPotato.