Affected Systems
BTCPay Server versions 2.4.1 (July 23, 2026) and earlier. Self-hosted instances with hot wallets containing Bitcoin, Litecoin, and potentially other cryptocurrencies. Public servers reportedly not targeted.
Exploitation Status
Active exploitation confirmed. Attackers draining hot wallets from outdated instances since at least October 29, 2026. Attack vector allows unauthorized admin login on versions older than 2.4.2.
Business Impact
Direct financial loss for organizations running outdated BTCPay Server instances with hot wallets. Attackers gain admin access and drain cryptocurrency holdings. Version 2.4.7 released as emergency patch; no credible theft reports from users running 2.4.7. Organizations using BTCPay for payment processing face operational disruption and potential customer trust issues.
Urgency
🔴 Immediate
Recommended Actions
- Immediately update BTCPay Server to version 2.4.7 via Server Settings → Maintenance → Update, or for Docker: SSH in, run 'sudo su -', 'cd btcpayserver-docker', then './btcpay-update.sh'
- If running version 2.4.1 or older, take the instance offline immediately until patched to prevent further wallet drainage
- Audit admin access logs and transaction history for unauthorized logins or suspicious cryptocurrency transfers since late October 2026
- Rotate all admin credentials and API keys after updating to version 2.4.7
- Report confirmed thefts to security@btcpayserver.org and local law enforcement with transaction details and timeline