BTCPay Server has clarified reports of funds being drained from users’ hot wallets. In a November 2 update, the team identified installations running version 2.4.1 or earlier. At that point, it had no credible reports of comparable drains on the current 2.4.7 release.
The initial warning appeared a day earlier, and the project urged operators to update their software. No final investigation findings, aggregate loss figure or conclusive explanation of how access was obtained have been publicly established.
BTCPay Server enables businesses to operate their own cryptocurrency payment infrastructure. It is not a centralized exchange holding every customer’s funds under a single operator. Reports concerning compromised installations also do not mean that the Bitcoin protocol was breached.
A hot wallet operates on an online system, making server security directly relevant to the funds it can access. The absence of confirmed incidents on a newer release is not a guarantee of immunity. Final conclusions depend on the investigation; the available evidence supports a warning to operators of older installations, not a definitive account of the attack’s scale.
Editorial illustration generated with AI for FinFly.news.