Source: thehackernews.com
BTCPay Server, an open-source self-hosted cryptocurrency payment processor, has been actively exploited by hackers to steal Bitcoin and Litecoin from hot wallets. The attacks specifically targeted instances running BTCPay Server version 2.4.1 (released July 23, 2026) or earlier. The BTCPay Server team has urged all users to immediately update to the latest version to mitigate the risk. Hot wallets, being internet-connected, are particularly vulnerable to such attacks. The exploitation appears to be actively ongoing, making this a high-severity incident for anyone running older versions of the software. No specific CVE identifier was mentioned in the available content, but the vulnerability is tied to a confirmed flaw in older releases.
