BTCPay Server Tells Operators to Shut Down Instances Amid Hot Wallet Attack Reports
BTCPay Server Warns of Hot Wallet Drains
BTCPay Server told operators to shut down their servers on Sunday after reports that attackers were draining hot wallets connected to instances running the software. BTCPay is a free, open-source tool that lets businesses accept Bitcoin, a digital currency, on their own servers.
The project issued the warning at 5:25 p.m. ET on November 1, 2026, saying it was receiving reports of unauthorized attackers sweeping hot wallets.
Key Details
- BTCPay urged server operators to shut down instances on November 1, 2026.
- Reports involved attackers draining hot wallets on older software versions.
- The attack targeted version 2.4.1, released on July 23, or older.
- The project said it had no credible reports of hot wallet drains for users running version 2.4.7.
- Hosting provider LunaNode automatically shut down BTCPay instances to prevent exploitation.
- BTCPay has not said how many servers were affected or how much Bitcoin was taken.
What the Investigation Found
About two hours after the warning, BTCPay founder Nicolas Dorier said the reports appeared to involve releases older than version 2.4.2 and that the attacker had logged in with administrator access.
Later on Sunday, BTCPay said its investigation identified an attack vector targeting instances running version 2.4.1 or older.
Emergency Update and Previous Issues
Version 2.4.7 was released on Thursday as an emergency update fixing one critical and several medium-severity vulnerabilities found through Anthropic's scanner. BTCPay has not said whether the attacks exploited any of those flaws.
In August, BTCPay warned that a critical vulnerability in all versions before 2.4.2 was being actively exploited. Supporters later funded a recovery bounty of 10% of any stolen funds returned, capped at 3 BTC.
About Hot Wallets
Because BTCPay is self-hosted, each merchant runs the software on their own server, and there is no central operator that can switch instances off. A hot wallet stores the wallet's seed on an internet-connected server so it can sign transactions automatically. BTCPay's own documentation labels the feature "DANGER" and warns that it comes with security implications.
Unanswered Questions
BTCPay has not disclosed how many servers were affected or how much Bitcoin was taken. The project also has not said whether the attacks exploited the vulnerabilities fixed in version 2.4.7.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.
Related Posts
BitMEX Shuts Down Crypto Trading, Leaves Withdrawals Open
Paradigm-backed Blast to shut down Layer 2 as costs outpace revenue
