Vulnerabilities · 3h ago
BTCPay Server’s maintainer urged users to install the latest version after hackers drained hot-wallet funds from outdated instances, BleepingComputer reports. The report does not say how attackers reached the servers or identify affected versions.
The loss is direct: a BTCPay instance connected to a hot wallet can put spendable cryptocurrency at risk, not just interrupt payment processing. The reporting does not establish whether upgrading closes a route attackers already used.
For operators whose BTCPay servers connect to hot wallets, updating alone cannot show whether an already-targeted instance is clean or whether funds were lost; the report provides no incident-response details.
2 sources covering this story
Hackers Exploit BTCPay Server Flaw to Steal Bitcoin and Litecoin From Hot Wallets
Hackers exploited a BTCPay Server vulnerability to steal Bitcoin and Litecoin from hot wallets on versions 2.4.1 and earlier.
BTCPay Server warns of hot wallet crypto thefts on outdated instances
The maintainer of BTCPay Server, an open-source cryptocurrency payment processor, has urged users to install the latest version as hackers have been draining
Part of the PlainSec briefing for 2026-11-03