BTCPay Server Tells Operators to Shut Down After Hot Wallet Drains
BTCPay Server told operators to take instances offline after reports that attackers drained connected Bitcoin hot wallets. The project narrowed suspected exposure to version 2.4.1 or older and urged updates to 2.4.7. The losses and the entry point remain undisclosed.
Operators of BTCPay Server, the open-source Bitcoin payment processor, have been told to take their instances offline after reports that attackers drained funds from connected hot wallets. The project's November 2 security alert initially applied to all users. Later guidance narrowed the suspected exposure to installations running version 2.4.1 or older.
In the alert, the project said it was investigating reports of unauthorized wallet withdrawals and asked operators to stop their servers using the `./btcpay-down.sh` script. Affected users were also asked to send incident details and server logs to the security team. BTCPay later said it had received no credible reports of hot wallet drains on the latest release, 2.4.7, and urged operators to update. Version 2.4.1 was released on July 23, 2026.
Administrator access, unknown entry point
Co-founder Nicolas Dorier said attackers logged in with administrator privileges on affected instances. How they obtained that access has not been determined. Dorier said the project's public servers, which run 2.4.7, were not attacked, and that affected installations appeared to be older than 2.4.2. He made the statement on X.
The project's own account also posted about the incident.
What is still unknown
BTCPay has not disclosed the amount stolen, the number of compromised servers or affected operators, or any technical details. No fix or recovery has been announced.
The statement did not establish that every earlier release was compromised, or that every installation on an affected version suffered a loss. Investigators also have not confirmed that newer versions are safe, and it is unclear whether this attack vector is connected to the August vulnerability.
Hosting providers including LunaNode shut down some installations as a precaution, so some operators may find their instances already offline.
Why hot wallets carry the risk
A BTCPay hot wallet keeps its seed on the internet-connected server and can sign payments automatically. The project's documentation marks this setup with a "DANGER" label. On such a configuration, an attacker with administrator access to the server is close to the funds themselves. BTCPay recommended that operators limit the balance held in hot wallets and move the excess to cold storage.
Context
The reports come less than three months after a separate incident. In August, the project warned of an actively exploited vulnerability that let attackers obtain LND administrator macaroon credentials and access connected Lightning wallets, detailed in our report on the earlier flaw. That bug did not affect ordinary on-chain hot wallets. Users were urged at the time to upgrade to 2.4.2 or shut down, and the project announced a recovery bounty of 10% of recovered funds, capped at 3 BTC.
The current reports involve Bitcoin hot wallets, and any link between the two incidents remains unconfirmed.
For operators still on 2.4.1 or earlier, the project's guidance comes down to two steps: shut the instance down, and update to the latest release.
