BTCPay Server: Attack vector discovered for versions 2.4.1 and earlier

BTCPay Server says its incident-response investigation has identified an attack path affecting instances running version 2.4.1 and earlier, released July 23, 2026. The open-source bitcoin payment processor stated there are no credible reports of hot wallet theft among users running the latest 2.4.7 release, and it is again urging all users to upgrade. The disclosure follows earlier reports that unauthorized attackers had drained funds from hot wallets on some instances, prompting BTCPay Server to advise users to shut down their instances while the investigation was underway. Affected users can submit incident details and logs to the security team. Watch for further findings from the ongoing investigation and any updated guidance on remediation for self-hosted deployments.