TLDR
- BTCPay Server told users to shut down their servers on Sunday after reports of attackers draining hot wallets.
- On Monday, the project said the attack targeted versions 2.4.1 and earlier, and it has no credible reports of drains on version 2.4.7.
- Founder Nicolas Dorier said an attacker logged in as an administrator on the hit servers, but the team does not know how.
- BTCPay has not shared the number of affected servers or the amount stolen.
- In August, a separate flaw in versions before 2.4.2 let attackers steal funds through Lightning credentials.
BTCPay Server, a free tool that businesses use to accept bitcoin payments, asked users to shut down their servers on Sunday. The project said it had received reports that attackers were draining hot wallets.
📢 Our incident response investigation identified an attack vector targeting instances running versions 2.4.1 (Jul 23, 2026) or older.
We have no credible reports of hot wallet drains for users running the latest 2.4.7 release. We again urge everyone to keep their BTCPay Server… pic.twitter.com/gYxK4Bb7fc
— BTCPay Server (@BtcpayServer) November 2, 2026
The call came through a post on X. BTCPay asked operators to run a command that stops the software until its investigation is finished.
On Monday, the project said it had found an attack vector affecting servers running version 2.4.1 or earlier. That version was released July 23, 2026. BTCPay said it had no credible reports of drains on its latest release, version 2.4.7, and urged operators to update.
How Hot Wallets Work on BTCPay
BTCPay is open-source software. Anyone can run it on their own server, and merchants receive bitcoin directly into their own wallets without a middleman.
A hot wallet stays connected to the internet. The seed phrase, which is the secret needed to send coins, is stored on the merchant’s server. The server can then sign and approve payments on its own.
BTCPay’s documentation marks this feature with a “DANGER” label. It says the feature “comes with security implications.” Anyone who breaks into the server can send the coins to their own address.
Because each merchant runs a private server, BTCPay has no master switch to turn them off. It had to ask each owner to shut down their own server.
What the Founder Said
About two hours after the first alert, founder Nicolas Dorier shared more details. He said the reports “appear to involve BTCPay Server releases older than version 2.4.2.”
He said the project’s own public servers run version 2.4.7 and “were not attacked.” He did not say whether newer versions are safe.
Dorier also said an attacker logged in as an administrator on the hit servers. That account has top-level access. The team does not yet know how the attacker got it.
What Is Still Unknown
BTCPay has not given a loss figure or a count of affected servers. It has not shared technical details on how attackers reached the wallets. It asked affected users to send information and logs to its security team.
Cointelegraph asked BTCPay for comment but did not get a response before publication. It is also unclear whether the latest attack is linked to an earlier flaw.
Earlier Security Problem
In August, BTCPay confirmed attackers had stolen funds through a flaw in versions before 2.4.2. The flaw let an outsider grab credential files for LND, software that runs a node on the Lightning Network. With those files, an attacker could control the node and move its funds.
BTCPay fixed that flaw in version 2.4.2 and later limited remote Lightning access. The latest reports came less than three months after that attack.
The reports also follow Thursday’s Binance hack. The exploiter drained cryptocurrencies worth over $6 billion, the largest exploit in crypto history.
As of Monday, BTCPay was urging all operators to update to version 2.4.7 while its investigation continues.
Stop guessing and start investing with confidence. KnockoutStocks gives you the AI insights, market intelligence, and stock research you need to spot opportunities, cut through the noise, and make smarter investment decisions — all in one powerful platform.
Sign up today and get 50% OFF full access to our premium stock picks.
Simply use coupon code SPECIAL50 at checkout to claim your exclusive discount.
Get 3 Free Stock Ebooks
Discover top-performing stocks in AI, Crypto, and Technology with expert analysis.
- Top 10 AI Stocks - Leading AI companies
- Top 10 Crypto Stocks - Blockchain leaders
- Top 10 Tech Stocks - Tech giants
