BTCPay Server Urges Merchants to Shut Down Amid Hot‑Wallet Drain Reports
BTCPay Server warned operators to disable their instances after reports of attackers emptying hot wallets on older software versions.
Self‑hosted Bitcoin payment tools face fresh security scare
BTCPay Server, the free open‑source software that lets merchants accept Bitcoin, posted a warning on November 1, 2026 urging operators to shut down their instances while it investigates reports of hot‑wallets being swept by unauthorized attackers.
The project’s official Twitter account posted at 5:25 p.m. ET: “We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers. If you’re running an instance, please shut it down (./btcpay-down.sh) until we complete the investigation.”
About two hours later, BTCPay founder Nicolas Dorie said the reports seemed to involve releases older than version 2.4.2, noting that the attacker had logged in with administrator access.
Subsequent updates from the project identified the attack vector as targeting instances running version 2.4.1, released on July 23, or older. The team added that it has “no credible reports of hot wallet drains for users running the latest 2.4.7 release” and urged everyone to keep software updated and to send details and logs to its security team.
Some hosting providers, including LunaNode, have begun automatically shutting down BTCPay instances that run older versions, the project said. BTCPay has not disclosed how many servers were affected or the amount of Bitcoin taken.
Because BTCPay is self‑hosted, each merchant runs the software on their own server, and there is no central operator that can turn instances off. Merchants may enable a hot‑wallet feature that stores the wallet’s seed on the internet‑connected server for automatic transaction signing. BTCPay’s own documentation labels this feature “DANGER” and warns of “security implications.”
The attacks follow the release of version 2.4.7 on Thursday, an emergency update that fixed one critical and several medium‑severity vulnerabilities identified by Anthropic’s frontier open‑source software scanner. BTCPay has not confirmed whether the recent attacks exploited any of those flaws.
This is not the first security alert for the project this year. In August, BTCPay warned that a critical vulnerability affecting all versions before 2.4.2 was being actively exploited, urging users to update or shut down their servers. Supporters later funded a recovery bounty of 10 % of any stolen funds returned, capped at 3 BTC.
Merchants using BTCPay should verify they run the latest version and consider disabling hot‑wallet functionality until the investigation concludes.
