ReportedUpdated 3 Nov 2026
BTCPay Server hot wallet crypto thefts
What happened
The maintainer of BTCPay Server, an open-source cryptocurrency payment processor, has urged users to install the latest version as hackers have been draining “hot wallets” on instances running older versions.
Reported impact
An affected population has not been established in the accepted evidence.
- Attack method
- exploiting vulnerabilities in outdated BTCPay Server versions
Source evidence
1Read the original reporting and statements. Multiple articles may rely on the same underlying source.
BleepingComputer01BTCPay Server warns of hot wallet crypto thefts on outdated instances
Retrieved 3 Nov 2026
Our incident response investigation identified an attack vector targeting instances running versions 2.4.1 (Jul 23, 2026) or older
Attributed reporting
1 more excerpt
The investigation focused on determining how the threat actor was able to log in as an administrator to instances running versions older than 2.4.2.
Attributed reporting
Updates and corrections
- Revision 1
Incident updated.