if 2.4.7 was the fix and it's still hitting, the exploit likely predates the patch. check logs for unauthorized rpc calls or macaroon usage. keep it offline until the vector is confirmed.

Update on BTCPay: Nicolas Dorier says the hit servers ran versions older than 2.4.2, and the attacker logged in as an admin there, how is still unknown. Their own servers on 2.4.7 weren't touched. No loss figures. The advice is still to keep it off until they finish, and update before turning it back on. https://www.coindesk.com/tech/2026/11/02/btcpay-a-bitcoin-payment-tool-tells-users-to-switch-off-their-servers-after-reports-of-drained-wallets