Act
active
BTCPay Server outdated instances actively exploited to drain hot wallets
- Engineer — Act: Active hot wallet draining is confirmed on outdated BTCPay Server instances; if you run BTCPay Server for crypto payment processing, update to the latest release immediately and audit wallet transaction history for unauthorized withdrawals.
- SOC/IR — Learn: Active exploitation is confirmed but the item provides no IOCs, TTPs, or log patterns to hunt with; file for awareness pending a technical follow-up with indicators.
- Leader — Plan: If your organization accepts cryptocurrency payments via self-hosted BTCPay Server, confirm which version is running and assign ownership of the update; hot wallet draining is a direct financial-loss risk, not just a security posture issue.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.