BTCPay Server Hot Wallet Theft Exploit Targets Outdated Versions

What happened

BTCPay Server, the open‑source payment processor that lets merchants accept Bitcoin directly into their own wallets, has announced that attackers are draining hot wallets from self‑hosted instances that are running version 2.4.1 or older. The thefts were discovered after several operators reported unauthorized outbound payments that could not be traced to legitimate customers.

The vulnerability is a remote code execution flaw that allows an attacker who can authenticate as an administrator to execute arbitrary commands. By exploiting a missing input validation in the admin API, the threat actor can log in, bypass two‑factor authentication, and transfer any balance stored in the hot wallet to an external address.

Who is affected

Any merchant or service that has deployed BTCPay Server on a public or private server and has not applied the latest security patches is at risk. The issue affects all installations that were built with the 2.4.1 release (July 23 2026) or earlier, regardless of the underlying operating system or hosting provider.

The attack does not target the official BTCPay hosting service; it is limited to self‑hosted instances where the operator has retained full administrative control. Users who have enabled the Lightning Network or other hot wallet features are especially vulnerable because the stolen funds are moved instantly to the attacker’s address.

Impact

Early reports indicate that at least five merchants have lost between $12,000 and $48,000 in Bitcoin, with the total loss exceeding $200,000 across the community. The stolen amounts were transferred to addresses that were not monitored by the operators, making recovery unlikely.

Beyond the financial hit, the incidents caused temporary service outages as operators shut down their servers to investigate. The downtime disrupted payment processing for several days, leading to lost sales and reputational damage for the affected businesses.

Exposure

The attackers gained administrative access by exploiting a flaw that allows the admin API to accept unescaped JSON payloads. Once authenticated, the attacker can issue a POST request to the /admin/withdraw endpoint, specifying any destination address and amount.

Because the vulnerability is present only in older releases, newer versions include a stricter authentication layer that requires a signed JWT and a valid session cookie. The flaw also opens the door to further lateral movement within the host if the attacker can execute shell commands.

What to do

All operators must upgrade to BTCPay Server 2.4.7, released on November 1 2026, which patches the admin API and enforces stricter input validation. The upgrade can be performed via the standard Docker or source build process and requires no downtime if the configuration is migrated correctly.

• Verify the current version by running btcpay-server --version on the host.
• Download the latest release from the official GitHub repository and replace the binary or Docker image.
• Restart the BTCPay service and confirm that the new version is active.
• Re‑enable two‑factor authentication for all admin accounts and enforce strong, unique passwords.
• Audit the list of admin users and remove any that are no longer required.
• Implement IP whitelisting or VPN access for the admin interface to limit exposure.

What to watch

The BTCPay team has pledged to monitor for any additional exploitation patterns and will release a security advisory if new variants are discovered. Operators should subscribe to the project’s mailing list and keep an eye on the GitHub issue tracker for any new CVEs.

Security teams should also monitor their network traffic for unusual outbound connections to Bitcoin nodes or Lightning peers, especially those originating from the admin API. Setting up alerts on the wallet’s transaction logs can provide early warning of unauthorized withdrawals.