BTCPay issued an alert at 6:25 AM this morning that coins in a server's hot wallet had been stolen, and running instances were immediately shut down. An update at noon revealed that the affected version was 2.4.1 and earlier. Version 2.4.2 was released on August 7th, with release notes stating it fixed a critical vulnerability being exploited. The latest version, 2.4.7, has no credible reports of theft and also fixes 85 security issues reported by the Anthropic scanning tool. According to this, the patch was released almost three months ago, and the money was lost on machines that hadn't been upgraded. The attacker's receiving addresses included bitcoin:native and litecoin:native. Self-custody eliminates the middleman, but doesn't eliminate the need for maintenance. The money in the hot wallet is sufficient for basic needs.