BTCPay Server Traces Hot Wallet Drains to Older Versions After Emergency Shutdown

• BTCPay Server urged operators to shut down instances after reports of unauthorized attackers sweeping connected hot wallets, while investigators worked to identify the attack vector.
• The investigation later narrowed exposure to version 2.4.1 and older. BTCPay said it had no credible drain reports involving version 2.4.7.
• Attackers obtained administrator access on affected servers, but the entry method remains unresolved. BTCPay has not yet publicly disclosed total losses or victim numbers.

BTCPay Server urged operators to shut down their instances after receiving reports that unauthorized attackers were sweeping Bitcoin from connected hot wallets. In an official security alert, the project told users to run its shutdown command while the investigation continued. Because each merchant operates its own self-hosted instance, BTCPay cannot centrally disable servers, making individual operator action necessary during emergency response. The warning affects Bitcoin payment infrastructure rather than the Bitcoin protocol itself, and the project has not disclosed how many operators were hit or the total value of stolen funds.

📢 Our incident response investigation identified an attack vector targeting instances running versions 2.4.1 (Jul 23, 2026) or older.

We have no credible reports of hot wallet drains for users running the latest 2.4.7 release. We again urge everyone to keep their BTCPay Server… pic.twitter.com/gYxK4Bb7fc

— BTCPay Server (@BtcpayServer) November 2, 2026

Investigation Narrows Attack Vector to Older BTCPay Server Versions

A later incident-response update identified the attack vector as affecting BTCPay Server version 2.4.1, released July 23, 2026, and earlier versions. The team said it had received no credible reports of hot-wallet drains involving the latest 2.4.7 release and urged operators to keep installations updated. That narrows the scope from the initial emergency shutdown, which was issued before the affected software range had been identified.

Founder Nicolas Dorier said the attacker gained administrator-level access on affected instances, but the method used to obtain that access had not yet been determined. BTCPay’s own public servers were running version 2.4.7 and were not attacked. Because hot wallets keep signing material available to an online system, administrator compromise can expose funds stored there. The incident therefore concerns compromised self-hosted server environments, not a failure of Bitcoin consensus or transaction validation.

The new incident follows an August security event affecting older BTCPay releases. That earlier vulnerability prompted an urgent upgrade to version 2.4.2 after attackers obtained Lightning-related credentials and stole funds. Crypto Economy covered the critical BTCPay vulnerability and emergency update, followed by the project’s 10% recovery bounty for stolen merchant Bitcoin. The available information does not establish whether the November attack vector is connected to the August flaw.

BTCPay has not published a definitive loss figure, victim count or full technical post-mortem for the latest hot-wallet drains. Affected operators were asked to provide incident details and logs to the project’s security team while the investigation continues. The episode adds to recent security pressure across Bitcoin infrastructure, including separate emergency shutdown guidance for Core Lightning operators. For BTCPay users, the immediate distinction is version-specific: older installations are the identified attack target, while version 2.4.7 had no credible drain reports in the latest update.