---
title: "BTCPay Server Links Hot-Wallet Sweeps to Deployments on Version 2.4.1 and Older"
description: "Developers urge operators running legacy software to upgrade, reporting no credible drains on the current 2.4.7 release."
url: https://basisdesk.news/news/btcpay-links-hot-wallet-drains-version-2-4-1
published: 2026-11-02T07:51:16.620Z
modified: 2026-11-02T07:51:16.620Z
section: Security & Hacks
author: Basis Desk Newsroom (AI-generated, source-verified)
sentiment: bearish
tickers: [BTC]
tags: [btcpay-server, hot-wallet, security-exploit, merchant-infrastructure, bitcoin-payments]
license: Quote with attribution to Basis Desk (basisdesk.news). Not financial advice.
---

# BTCPay Server Links Hot-Wallet Sweeps to Deployments on Version 2.4.1 and Older

Developers urge operators running legacy software to upgrade, reporting no credible drains on the current 2.4.7 release.

## At a glance

- **What happened:** BTCPay Server confirmed hot-wallet drain incidents are linked to versions 2.4.1 and older, urging immediate updates to version 2.4.7.
- **Why it matters:** Merchants running unpatched self-hosted payment instances risk complete automated loss of hot-wallet funds.
- **Who is affected:** BTCPay Server operators and merchants running software versions 2.4.1 or older.
- **What's next:** No next step announced.
- **Primary source:** [BTCPay Links Hot-Wallet Drains to Versions 2.4.1 and Older](https://thedefiant.io/news/hacks/btcpay-links-hot-wallet-drains-to-versions-2-4-1-and-older) — thedefiant.io

## Key points

- BTCPay Server confirmed hot-wallet drains are linked to software deployments running version 2.4.1 and older.
- The development team announced that there are no credible reports of unauthorized drains on version 2.4.7.
- Operators had previously been urged to shut down instances following initial detections of automated hot-wallet sweeps.

## Editorial remark

- **Context:** BTCPay Server previously urged operators to shut down instances after detecting unauthorized automated hot-wallet sweeps.
- **Impact:** Merchants and node operators maintaining unpatched instances on version 2.4.1 or older face ongoing drainage risks.
- **Watch:** Adoption rates for release 2.4.7 and any further official post-mortem advisories from the BTCPay development team.

Open-source payment processor BTCPay Server has linked recent hot-wallet drainage incidents directly to instances operating on version 2.4.1 and older [1]. 

Following the unauthorized asset removals, the development team explicitly advised server administrators to upgrade their deployments to the most recent release [1]. According to the team, there have been no credible reports of wallet compromises on version 2.4.7 [1]. The advisory follows earlier notices in which BTCPay Server urged system operators to shut down vulnerable services after detecting automated hot-wallet sweeps [1].

## Operator Guidance and Infrastructure Response

The project maintains that updating node instances remains necessary for protecting merchant balances [1]. While previous alerts instructed administrators to halt instances upon early reports of hot-wallet sweeps, current directives focus on bringing installations forward from version 2.4.1 or older releases to release 2.4.7 [1].

The software issues emerge alongside broader infrastructure security concerns across the crypto ecosystem, including separate incidents such as the [Coldcard Firmware Vulnerability Leads to $116M Bitcoin Self-Custody Theft](https://basisdesk.news/news/coldcard-firmware-exploit-116m-bitcoin-theft) [1]. At the time of writing, $BTC traded at $77,994 as merchants and autonomous payment processors assess potential exposure across self-hosted infrastructure.

## Sources

1. [BTCPay Links Hot-Wallet Drains to Versions 2.4.1 and Older](https://thedefiant.io/news/hacks/btcpay-links-hot-wallet-drains-to-versions-2-4-1-and-older) — thedefiant.io, 2026-11-02

---
Basis Desk Newsroom · AI-generated, source-verified · https://basisdesk.news/about/how-we-use-ai