BTCPay Server breach drains funds on outdated 2.4.1 systems

• Attack exploited pre-2.4.2 versions; funds drained from hot wallets.
• Latest update shields users; no cases on 2.4.7 or newer.

On November 2, 2026 (UTC), Cointelegraph reported that BTCPay Server, a leading open-source Bitcoin payment platform, confirmed that attackers exploited a software vulnerability in outdated server versions, draining funds from hot wallets on servers running version 2.4.1 (released July 23, 2026) or earlier. Attackers gained administrative access on these systems, allowing them to siphon funds, while the precise exploitation method remains under investigation.

BTCPay Server’s official alert advised all operators to immediately shut down and update any servers running versions older than 2.4.7 to mitigate risk. No unauthorized access was reported on servers running the latest version, 2.4.7, or newer.

The exploited vulnerability is likely related to, but not yet confirmed as, a critical flaw patched in August 2026 (version 2.4.2). That earlier bug enabled attackers to access Lightning Network Daemon credentials and drain associated funds, according to the Bitcoin Foundation. BTCPay Server repeated its recommendation not to keep large balances in hot wallets and urged impacted users to contact its security team directly.

This incident highlights persistent risks for crypto service providers that delay updating their infrastructure, as attackers increasingly target unpatched systems.

As of November 2, 2026, 12:08 UTC, Bitcoin (BTC) trades at $77,898.06, reflecting a 0.03% change in 24-hour trading volume, according to the latest market survey.