Hot-wallet sweeps reported on Sunday appear to have targeted BTCPay Server instances running releases older than version 2.4.2, according to Nicolas Dorier, founder of BTCPay Server. In those cases the attacker logged in as an administrator, and the team said it is still working to determine how that access was obtained.

Investigation points to 2.4.1 or earlier

BTCPay issued an alert at 5:25 p.m. ET on Sunday, posted on X, urging anyone running an instance to shut it down with ./btcpay-down.sh until the investigation is over. Dorier followed up roughly two hours later, noting that BTCPay's own public servers, running version 2.4.7, had not been attacked. He later said the team had traces indicating that "pre 2.4.2 vulnerabilities were used."

An update posted by BTCPay at 11:07 p.m. ET (here and here) narrowed the target: investigators identified an attack vector aimed at instances running version 2.4.1, released July 23, or earlier.

The project reported "no credible reports of hot wallet drains" from users on 2.4.7, which shipped October 29. It advised operators to keep their software updated and asked victims to send details and logs to its security team.

Some hosting providers may have shut instances down automatically to prevent older versions from being exploited. BTCPay thanked LunaNode and others for their prompt action. Dorier said operators who have updated at least once since 2.4.2 was released have "no reason to panic," while warning users not to hold too much in a hot wallet and promising a blog post with more detail.

Sunday's drains reached funds the August advisory deemed safe

Because BTCPay is self-hosted, the project cannot modify or shut down a merchant's server. Its hot-wallet mode signs payments with a seed stored on that server, meaning whoever controls the server can move the coins, according to BTCPay's documentation. In practice, a security release such as 2.4.2 protects a given server only once its operator installs it.

Version 2.4.2 dates to August. BTCPay released 2.4.2 on August 7 to patch a critical vulnerability that was already under active attack, as Cryptopolitan reported at the time. Every earlier release, including 2.4.2 release candidates, allowed an unauthenticated attacker to steal LND macaroon credentials, letting an attacker commandeer a Lightning node and move its funds. The project detailed the patch in its security advisory. Foundation and Citadel21 reported attacks on their Lightning nodes, and Craig Raw, developer of Sparrow Wallet, said he was also hit.

With the 2.4.2 release, LND macaroons were regenerated automatically. Operators who exposed LND through their own proxy, Tor service, or a forwarded port still had to change those credentials by hand. Version 2.4.2 also patched a separate TOTP two-factor bypass via the Greenfield API's Basic Authentication, reported August 4. BTCPay said that bug was unrelated to the macaroon hack and that its own on-chain wallets, including hot wallets, were not affected by that flaw.

Neither BTCPay nor Dorier has said whether Sunday's attacker exploited the August macaroon bug or another pre-2.4.2 vulnerability. The August macaroon bug was exploitable without any authentication; Sunday's intrusions, by contrast, involved administrator logins. In August, backers put up a recovery bounty of 10% of returned funds, up to 3 BTC, as Cryptopolitan reported. Separately, River reported that average merchant usage of Bitcoin grew 74% in 2025, with Lightning volume surpassing $1 billion per month — the kind of merchant payment activity that self-hosted software like BTCPay is built to process.