GoKawiilBTCPay Server confirms hot wallet thefts on outdated pre-2.4.2 instances
BTCPay Server's maintainers say attackers have been draining hot wallets from instances running version 2.4.1 or earlier, and are urging all users to upgrade to version 2.4.7. Founder Nicolas Dorier said the attacks exploited vulnerabilities predating version 2.4.2, not public-facing servers, and the project reports no confirmed drains on instances running the latest release.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident highlights the risk self-hosted crypto infrastructure faces when operators delay security updates, since a single unpatched vulnerability can lead directly to fund theft rather than just data exposure. The timeline suggests the flaw may have existed for months before being caught, which could prompt scrutiny of how BTCPay Server discloses and patches vulnerabilities going forward.
- Attackers targeted BTCPay Server instances running version 2.4.1 or earlier to drain hot wallets.
- Version 2.4.7 is the patched release, and no confirmed thefts have been reported on it.
- Affected users are asked to send logs to BTCPay Server's security team for investigation.
Ledger Nano X Hardware Wallet — If you're running a BTCPay Server, keeping crypto in a hot wallet is risky business, as this story shows. A hardware wallet like the Ledger Nano X keeps your private keys offline and isolated from server-side vulnerabilities, letting you move funds out of hot wallets into cold storage for safekeeping. It's a practical step for any business accepting Bitcoin to reduce exposure to exactly this kind of attack.
See Ledger Nano X Hardware Wallet on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-11-02
Published there as: “BTCPay Server warns of hot wallet thefts targeting outdated instances”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.