BTCPay Server Warns of Security Flaw in Older Software Versions Threatening User Funds

Earlier this week, the Bitcoin payment platform announced the identification of an attack vector targeting instances running version 2.4.1 or earlier, which was released on July 23, 2026.

The project emphasized it has no credible evidence of hot wallet theft among users running the latest release, version 2.4.7, and strongly encouraged operators to update their systems accordingly.

This development came after an earlier alert where BTCPay advised operators to shut down server instances amid investigations into unauthorized wallet withdrawals, providing detailed instructions on how to safely do so.

BTCPay has not revealed the number of affected operators, the amount of funds stolen, or the specifics of how the attackers gained wallet access. They have requested that impacted users share logs and information with the security team.

Cointelegraph sought comments from BTCPay Server but did not receive any response prior to publication.

These reports surfaced less than three months following BTCPay’s action to restrict remote Lightning Network access after an August attack exploited a vulnerability to steal credentials from the Lightning Network Daemon (LND) and pilfer funds.

It is still unknown whether this newly uncovered vulnerability is related to the previous incident in August.

The significance lies in highlighting the ongoing security risks present in outdated payment software versions and the vital importance of keeping systems updated to prevent fund theft.