BTCPay Server Identifies Attack Vector in Older Versions After Bitcoin Hot Wallet Drains

Published November 2, 2026, 12:25 PM PKT. Based on BTCPay Server's November 1, 2026 warning and November 2, 2026 incident-response update on X, founder Nicolas Dorier's statements, CoinDesk's November 1, 2026 report, Cointelegraph's November 2, 2026 report, Bitcoin.com's November 1, 2026 report, and crypto.news's November 2, 2026 report.

BTCPay Server, the open-source software merchants use to accept bitcoin payments on their own hardware, has told its entire self-hosted user base to pull the plug. The project issued an emergency shutdown warning on November 1, 2026, after receiving reports that attackers were sweeping bitcoin from hot wallets connected to self-hosted servers, and on November 2, 2026, its incident-response update narrowed the suspected exposure to older software: an attack vector targeting instances running version 2.4.1, released July 23, 2026, or older. The project said it has no credible reports of hot wallet drains among users running the latest release, version 2.4.7, and urged operators to keep their installations updated. What it has not done, as of this article, is disclose how much bitcoin was taken, how many servers were hit, or how the attackers got in.

The shutdown order: every server offline, no version carve-out

The alert arrived at about 22:25 UTC on November 1, 2026, on BTCPay Server's official X account, according to Bitcoin.com and crypto.news. The message read: "We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers. If you're running an instance, please shut it down (./btcpay-down.sh) until we complete the investigation." A wallet sweep moves the available funds out of a wallet in one go, and the command stops the software. The initial warning applied to all operators, with no limit to any particular version, and the project asked owners to leave their servers off until the investigation is complete. Core contributor Uncle Rockstar Developer reinforced the warning, writing, according to Bitcoin.com, "Not a drill: shut down your BTCPay Server if you have a hot wallet." Businesses took action quickly: Bitcoin.com reported that Coincards took its BTCPay installations offline following the warning, and crypto.news reported that hosting provider LunaNode shut down some installations as a precaution. BTCPay Server is free, open-source software, so there is no central operator that can patch or stop every deployment at once, which is why the shutdown command itself is the project's main protection while it investigates, according to CoinDesk's report.

The November 2 update: version 2.4.1 or older in the frame

About two hours after the initial alert, founder Nicolas Dorier gave the first narrowing of the picture, and the project's November 2, 2026 incident-response update went further. According to Cointelegraph, the project said its investigation identified an attack vector targeting instances running version 2.4.1 or earlier, released July 23, 2026. The update added that the project has no credible reports of hot wallet drains for users running the latest 2.4.7 release, and urged operators to keep their BTCPay Server installations updated. Crypto.news reported the same update, including the project's statement that it had received no credible reports of drains on 2.4.7. Operators who believe their servers were compromised have been asked to send incident details and relevant system logs to the project's security address, security@btcpayserver.org, according to crypto.news and Cointelegraph's reporting. The distinction matters for merchants deciding what to do next, but it is not an all-clear: Dorier stopped short of confirming that newer versions are safe, CoinDesk noted, and the original shutdown advisory was version-agnostic from the start and remains in effect.

What Dorier said, and what is still unknown

Dorier's preliminary findings, reported by CoinDesk, Bitcoin.com and crypto.news, are that the affected servers appear to be running releases older than version 2.4.2, and that an attacker logged in as an administrator on the hit servers. Administrator access is top-level access to the server, and it is the detail that makes the incident serious: a hot wallet that can sign transactions on the server is a wallet an attacker who reaches the server can sign with. But Dorier also said the team does not yet know how the attacker obtained that access, and no complete technical account has established whether the entry point was stolen login details, a software flaw, or another route, according to cybersecurity reporting reviewed for this article. Dorier said the project's own public servers, which run version 2.4.7, were not attacked, according to CoinDesk. That observation covers the project's own servers only, and it does not prove every updated installation is safe. Three basic facts remain undisclosed: the total bitcoin stolen, the number of affected servers, and any transaction identifiers that would let outsiders verify the losses independently. No compensation plan has been announced, which is expected for a self-hosted tool with no company holding customer funds, but it means affected merchants have no stated route to recovery beyond the investigation itself.

The August warning and the October patch behind this incident

This is the second time in about three months that unpatched BTCPay Server installations have been targeted, and the two incidents are related but not the same. In August 2026, BTCPay confirmed that attackers had stolen funds through a flaw in versions before 2.4.2, according to CoinDesk. Version 2.4.2, released August 7, 2026, addressed a critical vulnerability that was described as actively exploited at the time, according to the project's GitHub release record cited by crypto.news. That August incident let attackers obtain credentials for LND, the software that operates Lightning payment nodes, and drain funds from connected Lightning nodes, according to CoinDesk and Cointelegraph. At the time, BTCPay said its on-chain hot wallets were not affected by that incident. The November 1 reports are different: they involve on-chain hot wallets directly, and whether the two incidents share an attack vector has not been confirmed, according to Cointelegraph. Four days before the November warning, on October 29, 2026, BTCPay shipped version 2.4.7, an emergency release that fixed 85 security findings reported through Anthropic's open-source security scanning program: one critical, 13 high-severity, 52 medium-severity and 19 low-severity issues, according to Bitcoin.com and CoinDesk. The project has not said whether that release has any connection to the current reports, and there is no confirmed link between those fixes and the wallet drains, according to the reporting reviewed.

What operators should do now

The practical guidance, as it stands, is short and unchanged from the November 1 warning. Operators running any BTCPay Server instance should keep it shut down with ./btcpay-down.sh until the project completes its investigation, unless they are following the project's latest update guidance. Operators on version 2.4.1 or older should treat themselves as the exposed group and update to the latest release, version 2.4.7, once the project confirms it is safe to restart, and should not treat the absence of reported attacks on 2.4.7 as a guarantee. Anyone who believes a server was compromised should send incident details and server logs to security@btcpayserver.org, according to the project's update. Merchants who keep funds in a BTCPay hot wallet, rather than in cold storage or a separate wallet, are the ones at risk here: the Bitcoin network itself is not implicated, and the losses concern server-side key storage, not the blockchain. The next markers to watch are a root-cause statement from the project, any loss or victim count, and confirmation of when, if at all, operators may safely restart their servers.

This article is news reporting and is not investment advice.

Sources

• BTCPay Server, X post, November 1, 2026 (primary source: "We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers. If you're running an instance, please shut it down (./btcpay-down.sh) until we complete the investigation.")
• BTCPay Server, X incident-response update, November 2, 2026 (primary source: attack vector identified targeting instances running version 2.4.1, released July 23, 2026, or older; no credible reports of hot wallet drains on version 2.4.7; operators urged to keep installations updated)
• CoinDesk, BTCPay tells users to turn off their servers after reports of drained wallets (November 1, 2026, secondary source: shutdown warning, Dorier's preliminary findings on versions older than 2.4.2 and administrator access, public servers on 2.4.7 not attacked, no loss amount or server count disclosed, August flaw in versions before 2.4.2)
• Cointelegraph, BTCPay Server Identifies Attack Vector After Bitcoin Wallet Theft Reports (November 2, 2026, secondary source: November 2 update identifying the 2.4.1-or-older attack vector, no credible drain reports on 2.4.7, no disclosed victim count, loss value, or technical details of access)
• Bitcoin.com, Bitcoin Payment Processor Btcpay Hit by Hot Wallet Theft Reports (November 1, 2026, secondary source: 22:25 UTC warning time, Uncle Rockstar Developer "Not a drill" reinforcement, Coincards taking installations offline, version 2.4.7 released October 29, 2026 fixing 85 findings)
• crypto.news, BTCPay Server warns of wallet drains, urges server shutdowns (November 2, 2026, secondary source: November 2 update details, LunaNode precautionary shutdowns, security@btcpayserver.org reporting route, version 2.4.2 released August 7, 2026, investigation ongoing with no disclosed totals)
• TFTC, BTCPay Server Hot Wallet Drains: Emergency Shutdown Ordered (November 2, 2026, secondary source: version-agnostic shutdown advisory remains in effect, no fix issued, no loss total disclosed, no attack method confirmed)