BTCPay Server: Attack vectors discovered targeting version 2.4.1 and earlier

on November 2, according to an official BTCPay Server announcement, incident response investigations have identified attack vectors against instances running version 2.4.1 and earlier. Version 2.4.1 was released on July 23, 2026.

BTCPay Server stated that there are currently no credible reports of users running the latest version 2.4.7 having their hot wallet funds stolen, and urged users again to update the software. Affected users can submit incident details and logs to the security team.

TechFlow previously reported that BTCPay Server had received reports of unauthorized attackers transferring hot wallet funds, and advised users to shut down instances during the investigation.