GoKawiilBTCPay Server confirms hot wallet thefts on outdated pre-2.4.2 instances
BTCPay Server's maintainers say attackers have been draining hot wallets from instances running version 2.4.1 or earlier, and are urging all users to upgrade to version 2.4.7. Founder Nicolas Dorier said the attacks exploited vulnerabilities predating version 2.4.2, not public-facing servers, and the project reports no confirmed drains on instances running the latest release.