On Sunday, the open-source bitcoin payment processor asked operators to shut down their servers after attackers began draining merchant hot wallets. Because every merchant runs a self-hosted instance, the project has no central switch and had to rely on each owner to stop the software.

On Monday, the incident response team traced the attack vector to instances running version 2.4.1 (released July 23, 2026) or older. BTCPay says it has no credible reports of drains on the latest 2.4.7 release and urges everyone to update.

Founder Nicolas Dorier said the attacker logged in as an administrator on the affected servers, and the team does not yet know how that access was obtained.

No loss figure or count of affected servers has been disclosed. The incident comes less than three months after a separate August flaw in versions before 2.4.2 let attackers steal Lightning node credentials and move funds.