BTCPay Server: Attackers Drain Merchants' Hot Wallets on Outdated Servers
BTCPay Server, free open-source software that lets shops and merchants accept bitcoin without a payment provider in between, has warned its users of thefts. Attackers emptied the so-called hot wallets on self-hosted servers running outdated versions. The current version 2.4.7 is not affected, according to the project.
What happened
The project received reports of drained hot wallets – wallets whose private keys are stored directly on the payment server. Bitcoin and Litecoin were stolen. BTCPay initially advised all operators to shut down their servers while it investigated. It then announced that it had identified an attack vector targeting instances running version 2.4.1 (released on 23 July 2026) or earlier. The attackers apparently gained administrator access by exploiting vulnerabilities that were fixed in later versions.
On 29 October, the project had already disclosed a critical vulnerability and released version 2.4.7 as an emergency update. For this version, there are no credible reports of drained wallets so far. How many merchants are affected and how much was stolen has not been disclosed. It is also unclear whether the thefts are connected to an attack in August, after which BTCPay restricted remote access to Lightning nodes.
Who is affected
The thefts concern merchants and operators who run their own BTCPay Server, use a hot wallet on it and had not updated the software. Setups in which the server only knows the public key of an external wallet – for example a hardware wallet – keep no private keys on the server that could be used to spend funds.
What merchants should do now
- Update immediately: Install version 2.4.7 via Server Settings → Maintenance → Update. For Docker installations, the update script in the btcpayserver-docker directory does the same.
- Take outdated servers offline: If you run version 2.4.1 or older and cannot update right away, shut the server down.
- Check your settings: Make sure that no unknown administrator accounts exist and that the receiving wallet has not been changed.
- Keep little or nothing in the hot wallet: Where possible, connect a hardware wallet as a watch-only wallet, so that payments arrive directly in a wallet whose keys are not on the server.
- Report losses: Affected operators are asked to contact the BTCPay security team and file a report with the police.
Why it matters
BTCPay Server is a cornerstone of everyday bitcoin payments: it allows shops to accept bitcoin without fees to third parties and without giving up control. But self-hosting also means responsibility for updates. As with the recent Electrum vulnerability, outdated software was the weak point – not Bitcoin itself. Merchants who keep their server up to date and their keys off the server are on the safe side.
Sources
