BTCPay Server hack targets versions up to 2.4.1, total losses unknown

Self-hosted payment processor BTCPay Server has confirmed that attackers accessed hot wallets on servers running outdated software, affecting versions 2.4.1 and earlier. The project team stated that total losses have yet to be determined and investigators have still not explained how attackers obtained administrator-level access during the incident.

Scope and details of the breach

BTCPay Server, an open-source platform enabling merchants to process Bitcoin transactions independently, warned operators of a security breach after unauthorized parties reportedly drained funds from hot wallets. The project initially advised all operators to temporarily shut down their servers while the team investigated the attack and established which versions were vulnerable.

In its latest update, the team identified version 2.4.1, released in July 2026, and any earlier software as within the affected range. The ongoing investigation has revealed that attackers logged into the targeted servers with administrator credentials, but the underlying method for obtaining those credentials remains unconfirmed. No credible reports have surfaced of similar incidents on the latest release, version 2.4.7.

BTCPay Server confirmed it has “no credible reports of hot wallet drains from version 2.4.7,” narrowing the risk to outdated software and giving operators clearer information about their exposure.

Investigators identified traces pointing to vulnerabilities present in code versions older than 2.4.2. Still, it is unclear whether these vulnerabilities were directly linked to the method used by the attackers to gain unauthorized access.

Hosting providers, such as LunaNode, may have proactively shut down customer servers running outdated BTCPay Server software. However, this measure was noted only as a possibility, not as a confirmed action affecting all customers or hosts.

Security implications of hot wallets

Hot wallets—wallets that store private keys on servers to allow real-time transactions—are central to the risk that led to the thefts. With administrator privileges, attackers can potentially move any funds held in hot wallets, making these assets vulnerable if the underlying server is breached.

The current incident follows a previous warning about a critical vulnerability patched in version 2.4.2 in August. That flaw allowed remote attackers to obtain credentials for Lightning nodes and potentially drain connected wallets. This is now the second major theft reported in the past three months involving servers running software versions earlier than 2.4.2.

BTCPay Server founder Nicolas Dorier has recommended that operators limit the amount of funds held in hot wallets to minimize losses in the event of a compromise. He noted his own use of version 2.4.7 with a hot wallet setup but cautioned users to avoid storing more funds than they could afford to lose.

Mini dictionary: BTCPay Server, founded by Nicolas Dorier, is a community-driven open-source platform that enables merchants to accept Bitcoin payments without relying on third-party intermediaries.

Market reaction and continuing risks

Market data showed Bitcoin trading slightly higher on November 2, 2026, compared to the previous 24 hours, according to CoinGecko. However, there was no immediate evidence linking the price movement to the BTCPay Server hack, and broader weekly and monthly trends remained negative for the asset.

On the same date, the Crypto Fear & Greed Index was measured at 37, indicating a general “Fear” sentiment in the market. This gauge does not specifically reflect sentiment regarding the BTCPay Server incident, and the volume of funds taken during the attack remains undisclosed.

The team’s investigation continues, with administrators seeking clarity on how the compromise occurred and how many servers were impacted, while reiterating the importance of running the latest software version to minimize risks.

Next steps and investigation status

Investigation into the breach continues, focusing on how attackers gained administrator access and whether any specific vulnerabilities were exploited. The team has urged operators to keep affected servers offline until more information is available and reinforced its recommendation to update to the latest software version as soon as possible.

Further public updates are expected as investigators work to determine the full scope of the incident, issue official loss estimates, and provide renewed guidance for operators. The investigation has not concluded and no timetable has been set for a completed report.