BTCPay Server Urges Shutdowns After Bitcoin Wallet Thefts

• BTCPay Server told operators to shut down their payment servers after reports of attackers draining Bitcoin hot wallets.
• The suspected attack vector affects installations running version 2.4.1 or older.
• The project has received no credible reports of wallet drains involving its latest version, 2.4.7.
• Co-founder Nicolas Dorier said attackers logged in with administrator access, but how they got that access is still unknown.
• BTCPay Server has not said how much was stolen or how many servers were affected.

BTCPay Server has told users to shut down their payment servers after reports that attackers drained funds from connected Bitcoin hot wallets. The warning came in a security alert on November 2.

The open-source Bitcoin payment processor said it was looking into reports of unauthorized wallet withdrawals. It asked operators to temporarily turn off their instances using the ./btcpay-down.sh script.

At first, the warning applied to all users. The team later narrowed the suspected attack vector to installations running version 2.4.1, released on July 23, 2026, or earlier.

🚨 We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers.

If you're running an instance, please shut it down (./btcpay-down.sh) until we complete the investigation.

— BTCPay Server (@BtcpayServer) November 1, 2026

Older Versions Identified as Attack Targets

BTCPay Server said it had received no credible reports of hot wallet drains involving its latest release, version 2.4.7. The project urged operators to keep their software updated.

The team has not explained the technical weakness behind the intrusions. It also has not said how much cryptocurrency was stolen or how many servers were compromised.

📢 Our incident response investigation identified an attack vector targeting instances running versions 2.4.1 (Jul 23, 2026) or older.

We have no credible reports of hot wallet drains for users running the latest 2.4.7 release. We again urge everyone to keep their BTCPay Server… pic.twitter.com/gYxK4Bb7fc

— BTCPay Server (@BtcpayServer) November 2, 2026

BTCPay Server is a self-hosted payment tool. It lets merchants and individuals accept Bitcoin without a traditional payment company in the middle.

The attacks involved hot wallets, which stay connected to online systems. Funds in these wallets can be exposed if attackers gain enough access to the systems that control them.

Attackers Gained Administrator Access

Co-founder Nicolas Dorier shared more details in a separate statement on November 2. He said the project’s public servers, which run version 2.4.7, had not been attacked.

Dorier said the attacker was able to log in with administrator privileges on affected instances. The team is still working to find out how that access was obtained.

Based on the reports he had seen, affected installations appeared to be running versions released before 2.4.2.

The incident comes less than three months after an August breach. At that time, a flaw let attackers obtain Lightning Network Daemon (LND) administrator credentials and access connected Lightning wallets.

BTCPay Server said the August flaw did not affect ordinary on-chain wallets. It is not yet clear whether the new attack vector is linked to the earlier vulnerability.

Hosting providers, including LunaNode, have shut down some installations as a precaution. BTCPay Server said users on hosted services may find their instances were already turned off automatically.

The project has not shared a full list of hosting providers that suspended instances. Some operators may not be able to reach their payment servers until service is restored.

BTCPay Server recommends keeping only small amounts in hot wallets. It suggests moving extra funds into cold storage, where private keys are kept offline.

Affected users have been asked to send incident details and server logs to [email protected]. No timeline has been given for the end of the investigation, and no recovery of stolen funds has been announced.