BTCPay Server Reveals How Attackers Targeted Older Instances in Hot Wallet Incident

BTCPay Server said its investigation identified an attack vector affecting instances running version 2.4.1, released on July 23, 2026, or older, after reports that unauthorized attackers swept hot wallets. It said it has no credible reports of hot wallet drains on the latest 2.4.7 release, and founder Nicolas Dorier said public servers on 2.4.7 were not attacked; reports concerned versions before 2.4.2, where attackers logged in as administrators and traces showed pre-2.4.2 vulnerabilities were used. BTCPay Server did not disclose how much was lost or how many servers were affected. The platform is an open-source Bitcoin payment processor. Three months earlier, a flaw let attackers obtain LND admin macaroon credentials and access connected LND wallets.