BTCPay Server Hot Wallet Thefts Prompt Urgent Update Advisory
Maintainer warns users of active drainage of hot wallets on outdated instances
Key Takeaways
- Hackers are actively draining hot wallets from BTCPay Server instances running outdated versions.
- The maintainer has urged all users to update to the latest version to address exploited security flaws.
- Specific exploit details and CVE identifiers have not been publicly disclosed.
- Financial loss via theft of cryptocurrency hot wallet funds is the primary impact.
- Keeping BTCPay Server software updated is critical to preventing further incidents.
Quick answers
- What happened?
- The BTCPay Server maintainer has issued an urgent advisory warning that hackers are actively draining hot wallets from deployment instances running outdated versions of the open-source cryptocurrency payment processor. Users are strongly urged to update to the latest version to address the security flaws being exploited.
- Which products are affected?
- BTCPay Server
- What should defenders do?
- Users are strongly advised to update BTCPay Server to the latest available version to address the security flaws being exploited.
The maintainer of BTCPay Server, an open-source cryptocurrency payment processor, has urged users to install the latest version as hackers have been draining hot wallets on instances running older versions. According to the advisory, attackers are exploiting vulnerabilities or misconfigurations in older BTCPay Server releases to gain unauthorized access and siphon funds from hot wallets. The exact method of exploitation has not been publicly disclosed to avoid aiding potential attackers, but the maintainer emphasizes that the thefts are occurring against outdated instances. Users running older versions are advised to update immediately to the latest available release to mitigate the risk of further financial loss. The advisory highlights the importance of keeping BTCPay Server deployments up to date to protect cryptocurrency holdings stored in hot wallets.
Security Details
Attackers are exploiting vulnerabilities or misconfigurations in older BTCPay Server versions to gain access and drain hot wallets. Specific exploit details are not disclosed to avoid aiding attackers.
Affected products
BTCPay Server
Mitigation
Users are strongly advised to update BTCPay Server to the latest available version to address the security flaws being exploited.
Sources
BleepingComputer
BTCPay Server warns of hot wallet thefts targeting outdated instances
Nov 2, 2026 · 15:03
Original link
Related Security News
Critical Langflow Vulnerabilities Allow Unauthenticated Remote Code Execution
IBM reported two critical vulnerabilities in the Langflow open-source AI workflow platform that could allow unauthenticated remote attackers to bypass authentication and execute arbitrary code on affected servers. All versions from 1.0.0 through 1.12.8 are vulnerable; the only remediation is upgrading to version 1.13.0.
