BTCPay Server warns of hot wallet crypto thefts on outdated instances

BTCPay Server disclosed a security incident involving attackers exploiting vulnerabilities in outdated instances (version 2.4.1 or earlier) to gain administrator access and drain cryptocurrency from hot wallets. The project responded with an emergency update, version 2.4.7, released after a critical vulnerability was identified through Anthropic’s Frontier OSS scanner. Users are urged to update immediately, as no hot wallet drains have been reported on the latest version. Affected users are advised to report incidents and update their instances to mitigate further compromise.

AI-extracted · verify before operational use