BTCPay Server Urges Shutdowns After Bitcoin Hot Wallets Drained by Attackers
Author: Crypffalo Research · 14:58 02/11/2026
BTCPay Server told operators to shut down after attackers swept hot wallets; the attack vector targets versions 2.4.1 and older, and losses have not been disclosed.
BTCPay Server, the open-source software merchants use to accept bitcoin payments without an intermediary, told all operators to shut down their instances after reports that attackers were sweeping funds from hot wallets. The alert went out at around 22:25 UTC on Nov 1.
By Monday, the project said it had identified an attack vector targeting versions 2.4.1 (released July 23, 2026) and older. The number of affected servers and the value of stolen funds have not been disclosed.
Key takeaways
- Incident: Hot wallets on multiple BTCPay instances were drained after attackers gained administrator access.
- Scope: The identified attack vector targets version 2.4.1 and older; there are no credible reports of drains on the latest 2.4.7.
- Losses: No figure yet on compromised servers or bitcoin stolen.
- Guidance: Shut down with ./btcpay-down.sh, update the software and send logs to the security team if a breach is suspected.
- Market: Bitcoin is trading around $78,000–$79,000 with no notable reaction to the incident.
What happened
Late on Nov 1 UTC, BTCPay Server's official X account said it was receiving reports of hot wallets being swept by unauthorized attackers. It asked anyone running an instance to take it offline until the investigation was complete.
A core contributor added that this was "not a drill" for anyone running a hot wallet. The initial advisory applied to every version, with no exceptions.
Key moments (GMT+7):
- About 5:25 a.m. Nov 2: BTCPay issues its emergency shutdown call.
- Roughly two hours later: Co-founder Nicolas Dorier says affected servers appear to run releases older than 2.4.2 and that attackers obtained admin access.
- Later on Nov 2: The project confirms an attack vector against 2.4.1 and earlier, with no credible reports involving 2.4.7.
What is confirmed and what is still under investigation
Confirmed: attackers logged in to affected servers with administrator privileges and moved funds out of hot wallets. The project's own public servers, running 2.4.7, were not hit.
Still unknown: how the attackers obtained admin access, the technical details of the flaw, how many operators were affected and the total amount lost. BTCPay has not explicitly said whether 2.4.7 users can safely bring their servers back online.
The incident comes less than three months after an August attack that exploited a vulnerability to obtain Lightning Network Daemon (LND) credentials and steal funds, which led to the 2.4.2 patch. It is not yet clear whether the two incidents share an attack vector.
Why hot wallets are the weak point
A BTCPay hot wallet keeps the signing key on an internet-connected server so payments can be signed automatically. Anyone who takes over the server's admin account can use that key to move the funds.
A watch-only wallet, by contrast, stores only the public key on the server and relies on an external signer such as a hardware wallet. Based on current information, that setup is not exposed to this attack.
What it means for crypto markets
Price impact has been negligible so far, with bitcoin recovering toward the $78,000–$79,000 range after last week's Binance-driven selloff. The risk is concentrated among merchants and individuals who self-host BTCPay with a hot wallet.
- Bull case: Losses prove small and limited to outdated servers, updating to 2.4.7 closes the hole, and the story fades quickly.
- Risk case: The flaw reaches newer versions or losses turn out larger than expected, adding to infrastructure-security worries already heightened by the Binance and Chainalysis incidents.
The episode is also a reminder that self-custody shifts responsibility for patching and key management onto the operator.
What to watch next
- BTCPay's full technical post-mortem and guidance on restarting servers.
- Any disclosure of total losses and the number of compromised instances.
- Whether stolen funds move through exchanges or mixers.
- BTC price action around the Nov 3 US midterm elections; see the economic calendar and real-time liquidations.
Frequently Asked Questions
Are customers who paid merchants via BTCPay affected?
Not directly. The risk sits in the merchant's server-side hot wallet, not in the payer's wallet.
What should BTCPay operators do now?
The project advises shutting down, updating to the latest release and reviewing logs. Suspected breaches should be reported to BTCPay's security team.
Are watch-only wallets safe?
Based on current information, yes, because the signing key never sits on the server.
*This content is for information only and is not financial advice.*
Tags: Bitcoin, BTCPay, Security, Hack
Related articles
- THORChain halts swaps on 10 chains, stalling Binance hack laundering
- Binance sees $3.64B net outflows as withdrawals reopen after record hack
- Binance Reopens Withdrawals on 15 Networks, Says 95% of Hacked Assets Restored
- FBI confirms North Korea's TraderTraitor behind $6.4B Binance hack, flags 600+ addresses
- Chainalysis discloses breach, hackers accessed customer names and emails
- Binance replaces 90% of stolen crypto after $6.3B hack, eyes Sunday withdrawals