Executive Summary
The maintainers of BTCPay Server have issued an urgent security warning regarding active exploitation of outdated instances (version 2.4.1 and earlier). Threat actors are successfully compromising these self-hosted payment processors to perform unauthorized Bitcoin and Litecoin payments, effectively draining funds from 'hot wallets' managed by the software.
Technical investigation suggests that attackers are exploiting vulnerabilities fixed in version 2.4.2 (released August 7, 2026) to bypass authentication and log in as administrators. While a separate critical vulnerability was recently discovered using Anthropic’s Frontier OSS scanner (prompting version 2.4.7), the current thefts appear tied to older unpatched flaws.
This campaign poses a high risk to businesses and merchants using self-hosted crypto payment solutions. Affected users are urged to immediately update to version 2.4.7 or take their instances offline if updates cannot be applied immediately to prevent total loss of wallet funds.
Key Details
Threat Name
—
Affects
—
Adversary
—
MITRE Techniques
—
Malware/Tools
None identified