The BTCPay Server project is urging everyone to update after attackers drained hot wallets on older self-hosted instances, BleepingComputer reports.
What we know
- The project “identified an attack vector targeting instances running versions 2.4.1 (Jul 23, 2026) or older”
- The investigation is about how attackers logged in as admin on versions older than 2.4.2
- Separately, a critical bug found by Anthropic’s Frontier OSS scanner prompted the emergency 2.4.7 release on Oct 29
- “We have no credible reports of hot wallet drains for users running the latest 2.4.7 release”
- Operators were first told to shut down, and VPS hosts were asked to take affected instances offline
What to do
Update to 2.4.7, keep as little as possible in hot wallets, and check admin accounts and logs.
My take
Garlic because the investigation is still going. Self-hosting money means you own the patching.
God Bless, and Needs Garlic!
