BTCPay Server reported that attackers logged in as administrators on compromised servers, while users running version 2.4.7 received no credible reports of hot wallet drains

From the articleBTCPay tells users to turn off their servers after reports of drained walletsAlso in BTCPay Server Identifies Attack Vector After Bitcoin Wallet Theft Reports