TLDR
- BTCPay Server told operators to shut down their payment servers after reports of attackers draining Bitcoin hot wallets.
- The suspected attack vector affects installations running version 2.4.1 or older.
- The project has received no credible reports of wallet drains involving its latest version, 2.4.7.
- Co-founder Nicolas Dorier said attackers logged in with administrator access, but how they got that access is still unknown.
- BTCPay Server has not said how much was stolen or how many servers were affected.
BTCPay Server has told users to shut down their payment servers after reports that attackers drained funds from connected Bitcoin hot wallets. The warning came in a security alert on November 2.
The open-source Bitcoin payment processor said it was looking into reports of unauthorized wallet withdrawals. It asked operators to temporarily turn off their instances using the ./btcpay-down.sh script.
At first, the warning applied to all users. The team later narrowed the suspected attack vector to installations running version 2.4.1, released on July 23, 2026, or earlier.
Older Versions Identified as Attack Targets
BTCPay Server said it had received no credible reports of hot wallet drains involving its latest release, version 2.4.7. The project urged operators to keep their software updated.
The team has not explained the technical weakness behind the intrusions. It also has not said how much cryptocurrency was stolen or how many servers were compromised.
BTCPay Server is a self-hosted payment tool. It lets merchants and individuals accept Bitcoin without a traditional payment company in the middle.
The attacks involved hot wallets, which stay connected to online systems. Funds in these wallets can be exposed if attackers gain enough access to the systems that control them.
Attackers Gained Administrator Access
Co-founder Nicolas Dorier shared more details in a separate statement on November 2. He said the project’s public servers, which run version 2.4.7, had not been attacked.
Dorier said the attacker was able to log in with administrator privileges on affected instances. The team is still working to find out how that access was obtained.
Based on the reports he had seen, affected installations appeared to be running versions released before 2.4.2.
The incident comes less than three months after an August breach. At that time, a flaw let attackers obtain Lightning Network Daemon (LND) administrator credentials and access connected Lightning wallets.
BTCPay Server said the August flaw did not affect ordinary on-chain wallets. It is not yet clear whether the new attack vector is linked to the earlier vulnerability.
Hosting providers, including LunaNode, have shut down some installations as a precaution. BTCPay Server said users on hosted services may find their instances were already turned off automatically.
The project has not shared a full list of hosting providers that suspended instances. Some operators may not be able to reach their payment servers until service is restored.
BTCPay Server recommends keeping only small amounts in hot wallets. It suggests moving extra funds into cold storage, where private keys are kept offline.
Affected users have been asked to send incident details and server logs to security@btcpayserver.org. No timeline has been given for the end of the investigation, and no recovery of stolen funds has been announced.
