BTCPay Server Theft Reaches $1.63 Million in Bitquery Trace as Sweeps Continue Past Shutdown Alert

Published November 3, 2026, 9:20 AM PKT. Based on Bitquery's November 2, 2026 on-chain investigation (primary source), BTCPay Server's November 2, 2026 incident update as reported by BleepingComputer, and Abijita's November 3, 2026 coverage of the investigation (secondary sources). This is a follow-up to MABOnChain's November 2 article on the BTCPay Server hot wallet drains, which reported the attack vector and the shutdown warning at a time when no loss figure existed; this article covers only the first quantified loss estimate and what it adds.

Blockchain analytics firm Bitquery has put the first number on the BTCPay Server hot wallet thefts: $1,628,450 in Bitcoin and Litecoin, taken across 682 separate sweeps between October 30 and November 2, 2026. The firm traced 18.38 BTC and 3,405 LTC to two addresses published by BTCPay Server founder Nicolas Dorier, plus a second wallet it tied to the thief by transaction behavior. Bitcoin made up 88% of the traced value, with Litecoin accounting for the rest, at prices from the morning of November 2 ($78,326 per bitcoin and $55.54 per litecoin). The count stops at 06:00 UTC on November 2, and Bitquery says sweeps were still arriving when it stopped counting, so the true total is already higher than the published figure.

The $1.63 million trace: 682 sweeps across two chains

A sweep, in Bitquery's definition, is a single transaction that empties a wallet in one go, leaving no change behind. That definition is why the firm counts transactions, not victims: one shop swept five times looks identical on chain to five shops swept once, so Bitquery says it cannot tell how many servers were hit. The size distribution is lopsided. About half of the 682 sweeps were worth under $100, the kind of balance a small shop builds from a few days of modest orders, while sweeps of $10,000 or more made up 77% of the money. On Bitcoin, where Bitquery counted 534 sweeps, the ten largest hold 60% of the bitcoin taken. The single largest loss came in one block on November 1, when three sweeps built from 566 coins each landed together, worth $421,000 between them, a pattern Bitquery reads as one wallet emptied in three parts.

87% moved in one November 1 wave

The theft ran for about three days, but almost all of it happened in one afternoon and evening. The first sweep Bitquery can see came early on October 30, less than a day after BTCPay shipped version 2.4.7, and a trickle of smaller sweeps followed over the next day and a half. Litecoin sweeps began on November 1, and the Bitcoin wave started within the hour. Between 14:12 and 22:16 UTC on November 1, the thief took 87% of everything Bitquery counted, and the busiest single hour, from 16:00 UTC, moved $725,000. The first sweep came 62 hours before BTCPay's public alert, which went out at 22:25 UTC on November 1. By the time the alert landed, the main wave had mostly passed, but the sweeps did not stop.

267 sweeps after the shutdown alert

After the alert, Bitquery counted 267 more sweeps worth about $150,000, arriving in every hour through the night and still coming when the count stopped at 06:00 UTC on November 2. Shutting a server down stops a thief who needs that server to sign, and BTCPay said some hosting companies switched old servers off for their customers, but not every operator heard in time. The post-alert sweeps are the sharpest detail in the investigation, because they show the warning itself did not end the incident for servers that stayed online. One payout of 4.71 BTC was confirmed four minutes after the alert. At the cutoff, more than 99% of the traced funds still sat in addresses first used in the theft, and Bitquery had found no match between any address on the trail and its labels for known exchanges or services. Only about $1,600 had reached an older wallet in use since February, and the Litecoin address has never sent a coin.

The admin-login attack on servers 86 days behind

BTCPay said on November 2 that the identified attack vector targeted instances running version 2.4.1, released July 23, 2026, or older, and that it had no credible reports of hot wallet drains on the current 2.4.7 release. Dorier said the thief managed to log in as an administrator on affected instances, and that BTCPay had traces that vulnerabilities fixed in version 2.4.2 were used. Version 2.4.2, shipped August 7, fixed two serious holes, one letting anyone on the internet copy the files controlling a server's Lightning node and another letting someone who knew an account password sign in through BTCPay's programming interface without the two-factor code. A server still on 2.4.1 when the main wave hit had gone at least 86 days without that fix. BTCPay has not said which hole, or which mix of them, gave the thief admin access, and the route to that access remains under investigation. The first sweep also came less than a day after the 2.4.7 release, which fixed 85 problems found by an AI code scanner Anthropic runs for open-source projects. Bitquery notes the timing fits someone reading the newly published patches, but says it proves nothing, and BTCPay says it has no credible reports of drains on 2.4.7.

What merchants should do now

Bitquery's guidance, matching BTCPay's own, is direct: update to 2.4.7 or later before the server goes back online, and if the server ran 2.4.1 or older, assume someone else may have had admin access. Operators should read their wallet transaction lists for sends they did not make, look for admin accounts or API keys they did not create, move money out of the hot wallet into a new wallet with a new seed whose keys never touch the server, keep only what refunds and payouts need on the server itself, change admin passwords, replace each API key, and turn on two-factor sign-in. Anyone who lost funds is asked to send details and logs to security@btcpayserver.org, as BTCPay requested, and to report the losses to local authorities. The August Lightning credential incident, which BTCPay disclosed separately, remains distinct from these November on-chain hot wallet drains, and no link between the two has been established.

Bitquery cautions that its $1.63 million figure is a floor, not a ceiling: it follows only the two addresses BTCPay named plus one additional wallet it associated with the thief, and it excludes other addresses, Lightning transfers and other coins. BTCPay has still disclosed no official loss total and no count of affected servers, so the investigation's estimate is the best public number available, not a confirmed final tally. This article is news reporting and is not investment advice.

Sources

• Bitquery, BTCPay Server Hack: $1.6M Swept From Merchant Hot Wallets (November 2, 2026, primary source: $1,628,450 across 682 sweeps, 18.38 BTC and 3,405 LTC, 87% wave 14:12 to 22:16 UTC November 1, 267 post-alert sweeps worth $150K, 99% still in first-use addresses, floor figure, 2.4.2 fixes, merchant guidance)
• BleepingComputer, BTCPay Server warns of hot wallet crypto thefts on outdated instances (November 2, 2026, secondary source: attack vector 2.4.1 or older, no credible drains on 2.4.7, admin login, 2.4.7 emergency patch after October 29 disclosure, security@btcpayserver.org reporting route, update paths)
• Abijita, BTCPay Server Theft Reaches $1.63M in On-Chain Analysis (November 3, 2026, secondary source: 682 transactions October 30 to November 2, second wallet association, tally through 06:00 UTC November 2, no known exchange reached, BTCPay official total still undisclosed)