BTCPay Server Attack Hits Older Versions: What Bitcoin Merchants Should Do Now

TCPay Server’s incident response investigation team identified an attack vector granting unauthorized admin access and hot wallet drains on BTCPay Server versions 2.4.1, released on July 23, 2026, and older versions.

There are no credible reports of hot wallet thefts linked to BTCPay Server users using the latest 2.4.7 release. However, the incident raises concerns about why outdated self-hosted instances became vulnerable and what Bitcoin ($BTC) merchants should do to protect their funds.

Which BTCPay Server Versions Are Affected?

BTCPay Server has identified an attack vector that affects versions 2.4.1, released on July 23, 2026, and older versions. The project has stated there are no credible reports of hot-wallet drains involving users on the latest release, 2.4.7.

Meanwhile, this version boundary is the clearest guidance currently available from BTCPay Server’s team. Operators still on 2.4.1 or lower remain in the affected category, while those who upgraded to 2.4.7 (or at least past the earlier critical patches that began with 2.4.2) have not seen the same trend of compromises in the reports received at the time of reporting.

Why Have Outdated Self-Hosted Instances Become Vulnerable?

BTCPay Server is deliberately self-hosted and open-source. That design provides the merchants with full control, and there is no intermediary involved, but it also requires the operator to implement security updates, not the central company.

Patches to counter related vulnerabilities, such as critical issues that were patched in version 2.4.2 in August, had existed for about three months, and over several subsequent releases, when the latest reports appeared. That said, instances running 2.4.1 or older versions simply never received these updates.

The effect is increased by hot-wallet settings. In a typical BTCPay setup the hot wallet stores the signing keys (or seed) on the same internet-connected server that processes payments. This allows payouts and refunds to be automatic, but it also means that if an attacker manages to get administrative access to an old version, the money in the hot wallet is easily accessible.

What Should Bitcoin Merchants Do Now?

BTCPay Server continues to urge users to keep their software updated. $BTC merchants should verify their current version immediately and update any instance running version 2.4.1 or older to 2.4.7 using the standard upgrade process.

Hosting services like LunaNode automatically disabled older, exposed instances to reduce further exposure. $BTC merchants are advised to verify that their servers were disconnected and restart safely after updating following provider recommendations. They are also advised to store little money in hot wallets to recover daily refunds and Lightning liquidity, and transfer the rest of the Bitcoin to cold storage.

Furthermore, $BTC merchants should review recent transactions, change administrator passwords and API keys, and implement two-factor authentication. All users are requested to notify [email protected] about any suspected compromise with the proper details and server logs. Frequent updates and disciplined management of hot wallets are also crucial security measures.