Hot wallets drained on outdated BTCPay Server instances push merchants to 2.4.7
On November 1 and 2, 2026, attackers drained Bitcoin and Litecoin hot wallets on BTCPay Server instances running version 2.4.1 or earlier, after gaining administrator access through flaws fixed in 2.4.2. The maintainer is telling merchants to move to 2.4.7 or take their servers offline.