Hot Wallet Drains Force Emergency Updates on Outdated BTCPay Server Instances
Operators of the self-hosted cryptocurrency payment processor BTCPay Server are facing active hot wallet drains, prompting project maintainers to issue an urgent directive to update installations to version 2.4.7 immediately.
🚨 We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers.If you're running an instance, please shut it down (./btcpay-down.sh) until we complete the investigation.
The open-source platform allows businesses to accept Bitcoin and Lightning Network payments directly without intermediaries.
Operators were initially advised to take their servers completely offline pending a comprehensive investigation into unauthorized payments. Project founder Nicolas Dorier clarified that public servers were not the target of the breach. Instead, the incident response team zeroed in on how threat actors managed to authenticate as administrators on unpatched servers.
Anthropic Frontier Scanner Uncovers Critical Flaw Prompting Version 2.4.7
The security crisis escalated on October 29, 2026, when the company disclosed a critical vulnerability flagged by Anthropic’s Frontier OSS scanner. That discovery triggered the emergency release of version 2.4.7. Yet, maintainers quickly found evidence that attackers were exploiting separate, older weaknesses affecting software builds predating version 2.4.2.
Incident response investigations confirmed an active attack vector focused specifically on instances running version 2.4.1 from July 23, 2026, or earlier. Project maintainers stated that they have no credible reports of hot wallet drains impacting users running the current 2.4.7 release.
Security risks in self-hosted payment infrastructure are hardly new for the project. On August 7, 2026, the release of version 2.4.2 brought warnings regarding an actively exploited flaw that exposed Lightning Network Daemon credential files. That vulnerability granted attackers total control over affected Lightning nodes, leading directly to stolen funds. While current attacks mirror those historical risks, the project has not yet publicly clarified the exact mechanics of the vulnerability being leveraged in the latest wave of breaches.
Steps Required for Server Administrators to Patch Vulnerabilities
Administrators operating instances on version 2.4.1 or older are strongly advised to shut down their servers immediately to prevent further asset loss. Impacted users can apply the emergency patch by navigating through Server Settings, selecting Maintenance, and choosing Update within the dashboard interface.
Update on my part: Our public servers were not attacked (on 2.4.7), it seems reports are on before 2.4.2.The attacker managed to log in as admin on those instance, we are still trying to figure out how. https://t.co/PQvCQ3aafe
Docker deployments require manual intervention via secure shell access. Administrators must log in over SSH, execute sudo su -, navigate to the deployment directory by running cd btcpayserver-docker, and execute the update script with ./btcpay-update.sh.
The project requests that any affected users submit detailed activity logs and incident specifics directly to [email protected] to aid ongoing forensic analysis.
