BTCPay Server has linked a series of hot wallet attacks to merchant servers running versions older than 2.4.2, urging operators to update.
BTCPay Server, an open-source bitcoin payment gateway used by merchants, issued an alert urging operators to shut down their instances while it investigated reports of hot wallets being drained. Founder Nicolas Dorier later confirmed that only servers running releases earlier than 2.4.2 had been compromised, with the main attack targeting version 2.4.1, released in July 2026, or earlier. The project’s own servers, running version 2.4.7, were not affected, and there have been no credible reports of losses among up-to-date users.
Hot wallets at risk on unpatched servers
BTCPay Server is self-hosted, which means only server operators, not the BTCPay team, can control or shut down merchant servers. In hot wallet mode, the gateway signs transactions using a seed stored on the server itself, so anyone who gains access to the server can move the funds. Dorier stated that operators who have updated at least once since the 2.4.2 release are considered safe, and urged merchants not to keep excessive funds in hot wallets.
Several hosting providers, including LunaNode, automatically shut down vulnerable instances to prevent further losses, and BTCPay thanked them for their response. The team has asked affected operators to send server logs and details to its security team to support the investigation, and plans to publish detailed preventive guidance. It has not yet confirmed whether the attacks exploited a vulnerability fixed in August or another flaw predating version 2.4.2.
Link to August vulnerabilities
BTCPay released version 2.4.2 in August 2026 to fix a critical flaw that was already being exploited. Earlier versions allowed attackers to steal Lightning Network Daemon (LND) macaroon credentials and take control of Lightning nodes, and Sparrow Wallet developer Craig Raw, as well as Foundation and Citadel21, reported attacks on their nodes at the time. The patched version regenerated these credentials automatically, but operators of older versions had to update them manually.
Version 2.4.2 also fixed a separate bypass of two-factor authentication through the Greenfield API, which BTCPay said was unrelated to the credential exploit. BTCPay’s August advisory stated that on-chain wallets were not affected at the time, but the latest attacks show hot wallets remain exposed on servers that are not kept up to date. Following the August incident, supporters set up a bounty of up to 3 BTC for the recovery of lost funds.
