BTC $76,756 
ETH $2,255 
MGLOEURO $111,813 
USDT $0.9986 
BNB $698.47 
XRP $1.25 
USDC $0.9993 
SOL $92.08 
TRX $0.3186 
FIGR_HELOC $1.07 Hacks & Security · Explained
BTCPay Server warns of hot wallet thefts and urges server shutdowns
The self-hosted bitcoin payment processor says older software is affected and advises operators to update to version 2.4.7.
Key takeaways
- Broad first alert. BTCPay Server initially told operators generally to shut down instances, then narrowed the suspected vector to older releases.
- Version focus. The project pointed to version 2.4.1 or earlier and said it had no credible drain reports for version 2.4.7.
- Key unknowns. The number of affected operators, the amount stolen and the exact technical flaw have not been disclosed.
What happened
BTCPay Server, an open-source processor that merchants can host themselves to accept bitcoin, issued an emergency warning late on Nov. 1 UTC after reports that unauthorized attackers were emptying hot wallets connected to some payment servers. The project told operators to take instances offline with its ./btcpay-down.sh script while it investigated, according to Bitcoin.com News and Crypto.news. The first alert applied broadly to users rather than to a specific release.
By Nov. 2, the project had narrowed the suspected attack vector to installations running version 2.4.1 or earlier, a release dated July 23, 2026. BTCPay Server said it had no credible reports of hot wallet drains involving its newest version, 2.4.7, and urged operators to update. Cointelegraph reported that the project had not published technical details explaining how the wallets were accessed.
Co-founder Nicolas Dorier said attackers had logged in with administrator privileges on affected instances, though investigators had not established how they obtained access, Crypto.news reported. Dorier also indicated that the compromised deployments appeared to predate version 2.4.2, according to Bitcoin.com News. The project asked users who believed their servers were hit to send incident details and system logs to its security team.
Some hosting providers took precautionary action. LunaNode was among those that shut down installations, Crypto.news reported, and BTCPay Server said operators using hosting services might find their instances already offline. That could leave merchants unable to reach payment servers until service is restored. The project has not said how many servers were affected or how much cryptocurrency was taken.
First $84.7KLatest $78.3K-7.6% over the period
Points are daily observations, not closing prices.
Why it matters
BTCPay Server's self-hosted model gives merchants control over payment infrastructure, including software updates, server administration and wallet settings. That independence is central to its appeal, but it also means a security fix does not roll out automatically: publishing a patched release does not update servers run by independent merchants. Hot wallets stay connected to online systems so they can send transactions, leaving funds exposed if an attacker gains enough control of the machine. The warning prompted some businesses to choose downtime over keeping wallets reachable; Bitcoin.com News reported that Coincards took BTCPay installations offline. Dorier has reiterated that operators should keep only amounts they can afford to lose in hot wallets.
What the data shows
The advisories leave the scale of the reported thefts unknown. What is documented is a set of version and disclosure figures: the suspected vector involves version 2.4.1, released July 23, 2026, or earlier; version 2.4.7 is the release for which BTCPay Server says it has no credible drain reports; and the Oct. 29 update covered 85 vulnerability findings. The earlier August flaw was fixed in 2.4.2. The foundation's rewards for that earlier disclosure were 0.21 BTC to each of two recipients. Bitcoin.com News also noted that Anthropic's scanning initiative reported more than 29,000 candidate vulnerabilities over six months, only some of which received manual review. None of the reports provides a loss estimate for the hot wallet drains or a count of compromised servers.
Background
The incident follows an August 2026 security episode in which BTCPay Server warned of an actively exploited vulnerability that could lead to stolen funds. That flaw allowed unauthenticated attackers to obtain Lightning Network Daemon macaroon credentials, which act as authorization tokens, and was fixed in version 2.4.2, according to Bitcoin.com News. The project said the August issue did not expose its ordinary on-chain wallets, including hot wallets, Crypto.news reported. The BTCPay Server Foundation committed 0.21 BTC each to Sparrow Wallet developer Craig Raw and the Bitcoin Red Team fund for finding and reporting that vulnerability. On Oct. 29, BTCPay Server released version 2.4.7 after reviewing reports from Anthropic's open-source security scanning initiative; Bitcoin.com News said the release addressed 85 findings, including one critical, 13 high-severity, 52 medium-severity and 19 low-severity issues.
What is still unclear
Several central questions remain unanswered. BTCPay Server has not disclosed how many operators lost funds, the total value stolen or the technical weakness that allowed administrator access. It is also not established whether the latest thefts are connected to the August vulnerability, to another older flaw or to multiple weaknesses. Dorier's statement that public and demonstration servers running 2.4.7 were not attacked does not prove that every current installation is immune. The project has also not named all hosting providers that suspended instances or said how many servers were taken offline.
What to watch
BTCPay Server said developers were preparing a fuller explanation, and the supplied updates included no incident-specific patch or all-clear. Operators have been urged to move to version 2.4.7 and to preserve logs if they suspect compromise. The next developments to watch are the project's technical post-mortem, any revised guidance for hosting providers and whether additional merchants report losses. Core Lightning separately said it had received reports of attacks against vulnerable installations but had not determined whether funds were stolen, Crypto.news reported.
Questions readers ask
Which BTCPay Server versions are affected?
The project identified an attack vector affecting version 2.4.1, released July 23, 2026, or earlier. It said it had no credible reports of hot wallet drains on version 2.4.7.
How much bitcoin was stolen?
BTCPay Server has not disclosed a total loss figure or the number of compromised servers.
Is the incident linked to the August attack?
Investigators have not established whether the latest thefts are connected to the August vulnerability, another older flaw or multiple weaknesses.
Sources · 9 publishers
-
Bitcoin Payment Processor Btcpay Hit by Hot Wallet Theft Reports -
BTCPay Server warns of hot wallet thefts running on outdated software
-
BTCPay Server warns of wallet drains, urges server shutdowns -
BTCPay Server Hack Raises Alarm Over Bitcoin Wallet Security -
BTCPay Server Tells Merchants to Shut Down After Attackers Sweep Hot Wallets: Are Payments Still Safe? -
BTCPay Server Urges Shutdowns After Bitcoin Wallet Thefts -
BTCPay Server Reports No Wallet Drains on Latest Release After Asking Merchants to Go Offline -
BTCPay Tells Merchants to Switch Off Servers Amid Hot Wallet Attack Reports -
BTCPay Server Reveals How Attackers Targeted Older Instances in Hot Wallet Incident
