BTCPay Server warns of unauthorized access to users' hot wallets, urging a temporary shutdown of servers pending investigation.
BTCPay Server developers have issued a warning regarding unauthorized withdrawals from users' hot wallets, urging server operators to temporarily shut down their systems until the situation is fully assessed.
🚨 We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers. If you’re running an instance, please shut it down (./btcpay-down.sh) until we complete the investigation.
— BTCPay Server (@BtcpayServer) November 1, 2026
The initial alert was posted on November 1st at 22:25 UTC, with developers suggesting the use of the script ./btcpay-down.sh to disable servers.
As an open-source payment solution, BTCPay Server allows businesses to independently accept Bitcoin without intermediaries, with users hosting the software on their own servers. This decentralized structure means the team cannot shut down all instances directly.
Hot wallets, where the seed phrase is stored on an internet-connected server for ease of transaction signing, pose risks if unauthorized access is gained.
Affected Software Versions Identified
Nicolas Dorier, the project's founder, indicated that servers running versions prior to 2.4.2 were likely targeted. Public servers operating on version 2.4.7 were not compromised.
Update on my part: Our public servers were not attacked (on 2.4.7), it seems reports are on before 2.4.2. The attacker managed to log in as admin on those instance, we are still trying to figure out how.
— Nicolas Dorier (@NicolasDorier) November 2, 2026
The breach reportedly allows attackers to log in as administrators on affected systems, with the specific method of access still under investigation. The team has confirmed that versions 2.4.1 and earlier are at risk, while no confirmed thefts from the latest version have surfaced.
Users operating on outdated versions have been encouraged to report incidents and server logs to security@btcpayserver.org. Additionally, hosting providers promptly disabled outdated server instances to prevent exploitation.
The total number of compromised installations, the extent of losses, and the identities of the attackers are currently unknown.
Recent Security Update Addressed Vulnerabilities
On October 29, a new version, 2.4.7, was released, fixing 85 vulnerabilities identified through the Anthropic OSS Scanner, including one critical issue. Developers stressed the importance of this update, especially for those managing multiple stores.
While the link between the current thefts and previously resolved vulnerabilities remains unconfirmed, a previous incident in August saw hackers draining Lightning nodes through a critical flaw in BTCPay Server. This vulnerability was patched in version 2.4.2, prompting similar warnings for users at that time.
