BTCPay Server’s investigation identified an attack vector targeting instances running version 2.4.1, released on July 23, 2026, or older, following reports of unauthorized attackers sweeping hot wallets. The open-source payment processor reported no credible incidents affecting users running the latest 2.4.7 release. Founder Nicolas Dorier confirmed the attacker gained admin login access on pre-2.4.2 instances, though the exact method remains under investigation. Neither the amount lost nor the number of affected servers has been disclosed. The incident comes roughly three months after a vulnerability that allowed attackers to steal LND admin macaroon credentials, and days after the Binance hack, attributed by the FBI to the North Korean state-sponsored group TraderTraitor, which drained over $6 billion.
Source: Read the original article
