BTCPay Server has narrowed an emergency investigation into reported Bitcoin hot-wallet sweeps to installations running version 2.4.1 or older. The open-source payment project said on November 2 that its incident response had identified an attack vector targeting the July 23 release and earlier versions. It added that it had received no credible reports of drains involving the latest release, 2.4.7. The update reduces the apparent scope of the warning, but it does not establish how many merchants were hit or how the attacker obtained access.

An emergency shutdown warning came first

The project initially told all operators to shut down their instances after receiving reports that unauthorized attackers were sweeping hot wallets. A hot wallet keeps signing material on an internet-connected system so a merchant can automate payments, refunds or other transactions. That convenience also means an intruder with sufficient server privileges may be able to move funds without a separate hardware-device approval. BTCPay's warning was operational, not a claim that every server or every wallet configuration had been compromised.

Related reporting: Core Lightning 26.06.9 Fixes Node Security and Payment Delays

The scope is narrower, but important gaps remain

BTCPay's follow-up named version 2.4.1 and older as the target and urged users to keep software current. Founder Nicolas Dorier separately said attackers had logged in as administrators on affected instances, while the method used to gain that access remained under investigation. Neither statement disclosed the amount of Bitcoin taken, the number of affected servers, wallet addresses or a technical description of the attack vector. The absence of credible reports on 2.4.7 is therefore evidence about reports received so far, not proof that every newer installation is immune.

Release 2.4.7 predates the latest alert

Version 2.4.7 was published on October 29, before the November wallet-sweep warning. Its official release notes describe 85 security findings fixed across authentication, invoices, payouts, application settings and other functions, including one issue rated critical by the underlying report. The notes strongly recommend updating, especially for servers shared by multiple merchants, but they do not identify the newly reported wallet sweeps as the reason for the release. That distinction matters: the project has associated observed cases with old versions without yet publishing a postmortem that links the incident to a named flaw or fix.

The August incident was different

BTCPay also faced an actively exploited vulnerability in August. That earlier flaw affected releases before 2.4.2 and could expose LND administrator macaroon credentials, allowing control of connected Lightning nodes. BTCPay said at the time that ordinary on-chain wallets, including hot wallets, were not affected by that vulnerability. The new reports specifically concern hot wallets, so the August advisory cannot be treated as an explanation of the November event unless the project establishes a connection. The shared version boundary is notable, but it is not proof that the same weakness was used.

Merchants still need a definitive incident report

BTCPay's self-hosted model gives merchants direct control of payment infrastructure and removes a central custodian, but it also makes patching and server administration the operator's responsibility. Hosting providers may intervene for managed deployments, while independent operators must verify their own version and exposure. The next useful evidence will be a technical advisory, a loss and victim estimate, indicators of compromise and an explicit all-clear or remediation path. Until those details arrive, the verified conclusion is limited: reported sweeps have been tied to version 2.4.1 or older, 2.4.7 has no credible reported drains, and the investigation remains open.

Sources

AI-generated editorial image; not a photograph of the reported event. Prepared with AI assistance and source verification.