BTCPay Founder: The theft report appears to involve versions prior to 2.4.2

BTCPay Server founder Nicolas Dorier said on November 2 that reports of stolen funds appear to involve versions of the open-source bitcoin payment processor prior to 2.4.2, with attackers logging into affected instances as administrators, though the team is still investigating how access was gained. Dorier noted that public servers running version 2.4.7 were not affected. The reports follow earlier disclosures that unauthorized actors had transferred funds from hot wallets, prompting BTCPay Server to advise users to shut down their instances until the investigation concludes. The incident matters because BTCPay Server is widely used by merchants and nonprofits for self-custodial bitcoin payment processing, making admin-level compromises a direct threat to merchant hot wallets. Users and operators should watch for the team's findings on the attack vector, any patched release beyond 2.4.7, and updated guidance on when it is safe to bring instances back online.