BTCPay Server tells operators to update after Bitcoin and Litecoin stolen from hot wallets

BTCPay Server has told operators to install the latest version of its software after reports of Bitcoin and Litecoin being stolen from hot wallets on instances running older releases. The project is a self-hosted, open-source cryptocurrency payment processor, which means the servers holding the funds belong to whoever runs them.

In a statement quoted by The Hacker News, the project said its investigation found the attacks targeted servers running BTCPay Server 2.4.1, released on 23 July 2026, or earlier. That's the whole of the technical detail in the report so far.

What's missing matters as much as what's there. Nobody has said how the attackers got in, whether a specific vulnerability is involved, or how much was taken. The project's wording points at older versions, but the report doesn't describe a fix or name a patched release, so we wouldn't read "update" as confirmation that a single bug was closed.

For anyone running an instance, the practical step is the one the project asked for: move to the current version. If a server has been on 2.4.1 or earlier and holds funds in a hot wallet, treat the wallet as exposed and check its balances and transaction history rather than assuming an update settles it.

We'd also expect more detail from the project before drawing conclusions about the mechanism. Until then, the version range is the only firm indicator published.