Source: Coinspeaker
Neutral

BTCPay Server tells merchants to update to 2.4.7 to prevent drains

На русском
4 min

BTCPay Server urged operators to shut down instances after reports of hot-wallet drains on merchant servers. The investigation later traced the attack vector to outdated software: instances on version 2.4.1, released July 23, or older. The project reported no credible drains on 2.4.7 and has not disclosed the number of stores affected or total losses. Hosting providers proactively stopped older hosted instances, which may leave some stores offline.

What Happened to the BTCPay Server Hot Wallets?

An attacker obtained admin access on older BTCPay Server instances and emptied hot wallets. BTCPay Server raised an alert at 22:25 UTC on Sunday and asked operators to run its shutdown script until the investigation completed. Founder Nicolas Dorier said two hours later that public servers on 2.4.7 were not hit and that the attacker logged in as admin on affected instances.

At 04:07 UTC, the project stated the attack targeted versions 2.4.1 or older and that it had no credible reports of drains on 2.4.7.

A hot wallet stores signing keys on the server to automate refunds and payouts. Admin rights on that server enable spending from those wallets. Hosting partners acted quickly: BTCPay thanked LunaNode and others for shutting down outdated hosted instances.

Version history indicates rapid patching: 2.4.1 shipped July 23. Version 2.4.2 followed two weeks later with a fix for a critical flaw that was being actively exploited. Five additional releases culminated in 2.4.7 on Thursday, which addressed 85 findings from an Anthropic AI security scan.

Whether the current incident matches August’s flaw remains unconfirmed. Dorier said a detailed blog post is coming.

Is Your BTCPay Server Store Exposed?

Exposure: instances on 2.4.1 or older. Dorier wrote that stores updated at least once since 2.4.2 have no reason to panic.

What operators should do now:
- Check the version: anything at 2.4.1 or below remains offline until updated.
- Update to 2.4.7: use Update under Server Settings → Maintenance. Docker installs: run the btcpay-update.sh script over SSH. Umbrel or Start9: install via the platform as outlined in BTCPay’s guide.
- Keep the hot wallet thin: sweep sales to cold storage and leave only funds needed for refunds.
- Report a drain: send details and logs to security@btcpayserver.org.

The reported drains targeted hot wallets. Stores configured with a watch-only wallet keep signing keys off the server.

Did This Bitcoin News Move the BTC Price?

No. BTC was at $77,890 when the alert went out and traded at $78,102 on Binance at 07:40 UTC on Monday, up 0.3% over 24 hours. The market remains focused on last week’s Binance hack. Price held the October 30 low at $76,326 near the 200-day EMA, now $76,512, for three days. Overhead levels: the 50-day EMA at $80,293 and $81,971, the October 29 high. The Fear & Greed Index reads 37, which indicates fear, and BTC is down 2.5% on the week.

August 5 to November 2, 2026: BTCUSDT 1D chart. Source: TradingView

August 5 to November 2, 2026: BTCUSDT 1D chart. Source: TradingView

Outlook Trigger Level to watch
Rebound A daily close above $80,293 $81,971, the October 29 high
Holding pattern Holding between $76,326 and $80,293 A range between the two EMAs
Sell-off A daily close below $76,326 $74,968, the September 15 low

Original publication

Authors credited by the source: Daniel Francis

Published by Holder based on an external source.