BTCPay Server, the self-hosted open-source cryptocurrency payment processor, has urged users to update after reports that attackers exploited a flaw to steal Bitcoin and Litecoin from hot wallets on older installations. According to the project, the incidents affected servers running BTCPay Server 2.4.1 or earlier.

What happened

BTCPay Server said its investigation found that the attacks targeted outdated instances of the software, specifically version 2.4.1 and earlier. The reported impact is theft from hot wallets, meaning wallets connected to online systems and used for day-to-day payment operations.

Based on the source report, BTCPay Server has advised users to install the latest available version. The available information indicates active exploitation, not just a theoretical vulnerability, which raises the urgency for organisations still operating older deployments.

Why it matters for European businesses

For European companies that accept cryptocurrency payments, this is a practical operational and security issue rather than a niche technical story. BTCPay Server is used precisely because it is self-hosted and gives merchants more control over payment infrastructure. That control also means the business is typically responsible for patching, wallet configuration, monitoring and incident response.

If an attacker can access funds held in a hot wallet, the consequences may include direct financial loss, disruption to payment operations, accounting complications and reputational damage with customers or partners. Businesses using crypto payment infrastructure may also need to review whether any incident affects internal controls, treasury handling or reporting obligations.

The case is also a reminder that self-hosted payment and commerce systems need the same patch management discipline as websites, e-commerce platforms, CRM tools and cloud applications. Open-source software can be highly effective, but security responsibility remains with the operator.

Who may be affected

• Merchants and e-commerce companies accepting Bitcoin or Litecoin through self-hosted BTCPay Server instances
• Digital agencies and IT providers managing BTCPay Server for clients
• Businesses with hot wallet balances kept online for payment settlement or liquidity
• Organisations running older versions, especially version 2.4.1 or earlier, according to BTCPay Server's statement

Companies using custodial payment providers rather than self-hosted BTCPay Server may not face the same direct exposure, but they should still confirm with providers how wallet security and patching are handled.

What companies should consider

• Update immediately if any BTCPay Server instance is running version 2.4.1 or earlier, following the project's latest guidance
• Review hot wallet exposure and reduce online balances where operationally possible
• Check transaction history and wallet activity for unauthorised transfers or unusual access patterns
• Verify backup and recovery procedures for wallet infrastructure and related payment systems
• Limit administrative access to servers and management interfaces, and review authentication controls
• Clarify ownership of patching if the system is managed by an external developer, hosting partner or agency
• Separate operational funds from reserves so only necessary liquidity remains in hot wallets

For SMEs, the broader lesson is straightforward: self-hosted payment infrastructure can reduce dependency on third parties, but it requires active security maintenance. Businesses using crypto payments should treat these systems as part of their critical financial infrastructure, with clear responsibility for updates, monitoring and wallet risk management.