BTCPay Server's founders issued an urgent late-night alert on 1 November telling operators to shut down their servers immediately after reports that attackers were sweeping bitcoin from hot wallets.
At approximately 22:25 UTC, BTCPay Server's official account published an urgent notice. "We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers," the account said.
While they examined the incident, investigators asked operators to take their instances offline with the ./btcpay-down.sh command. Core contributor Uncle Rockstar Developer echoed the warning: "Not a drill: shut down your BTCPay Server if you have a hot wallet."
An open-source tool, BTCPay Server lets merchants accept bitcoin directly rather than through a traditional payment intermediary. Businesses, including Coincards, took BTCPay installations offline after the warning.
Which versions are vulnerable
BTCPay Server said the vulnerability affected installations on version 2.4.1 and older; that release came out 23 July 2026. Founder Nicolas Dorier connected the reported compromises to versions before 2.4.2, while public servers on version 2.4.7 had not been attacked.
Forensic traces suggest attackers gained administrator access by exploiting weaknesses in the older releases. Users on the newest release, version 2.4.7, hadn't reported any credible hot wallet drains, BTCPay Server said, and the company called on operators to update their installations.
Pattern of security incidents
- AugustLightning vulnerability exploited
An attack exposed Lightning Network Daemon credentials, leading to the restriction of remote Lightning access. The flaw was corrected in version 2.4.2.
- 29 OctoberSecurity patch released
Version 2.4.7 released after receiving vulnerability reports from Anthropic's open-source security scanning initiative, addressing 85 findings including one critical, 13 high-severity, 52 medium-severity, and 19 low-severity issues.
- 1 NovemberEmergency shutdown warning
BTCPay Server issued urgent alert after reports of attackers draining funds from hot wallets on outdated software versions.
Less than three months before the latest attack, BTCPay limited remote Lightning access after an attacker exploited a vulnerability to obtain Lightning Network Daemon credentials and steal funds. It's unclear whether the recent thefts stemmed from that weakness, a different older flaw or several vulnerabilities.
What remains unknown
What we know
- The attack vector targets outdated versions of BTCPay Server software.
- Attackers obtained administrator access to compromised instances.
- Version 2.4.7 has not been compromised in confirmed attacks.
- BTCPay Server requested affected users submit information and logs to its security team.
Still unclear
- The total bitcoin stolen or the value of stolen funds.
- The number of affected operators or merchants.
- The precise technical means by which attackers gained entry.
- Whether this breach exploits the same August vulnerability or a different flaw.
Developers had yet to disclose how much bitcoin was stolen or how many merchants were affected at press time. The initial alert did not confirm how attackers gained access to the compromised systems.
Operators should keep hot-wallet balances to sums they could afford to lose, founder Nicolas Dorier said. The supplied updates gave no firm estimate of losses, incident-specific patch or all-clear.
Developers were preparing a fuller explanation.
