.png){kind=logo}
Attackers gained administrator access to outdated BTCPay Server installations and drained their hot wallets, prompting developers to urge operators to shut down instances while they investigate. The project warned operators on November 1 after reports of unauthorized withdrawals. Its team has not disclosed the amount stolen, the number of affected servers, or how attackers obtained administrator access.
A subsequent update narrowed the attack's known scope to version 2.4.1, released on July 23, 2026, and earlier builds. Developers reported no credible hot-wallet drains involving version 2.4.7, the current release. They have not established the precise entry point.
BTCPay Server founder Nicolas Dorier said attackers had logged into affected installations with administrator privileges. That access gave intruders control over hot wallets on those servers. Yet investigators still lack a confirmed explanation for the unauthorized logins.
The team found traces of security flaws that existed before version 2.4.2. It has not said whether those flaws explain every reported theft. As the investigation continues, operators running older software face an immediate decision about keeping payment services online.
Developers urged every administrator to stop their instance using the /btcpay-down.sh command. Since merchants host the payment software themselves, individual operators must carry out the shutdown. The notice applies broadly while investigators work to determine the cause.
Hosting providers also took action. The team said LunaNode and other providers may have stopped customer instances. It did not specify how many hosted servers those measures affected.
The November reports follow an August attack involving BTCPay Server installations older than version 2.4.2. That release addressed a critical weakness that allowed remote attackers to obtain Lightning Network credentials and drain connected wallets. Attackers had already begun exploiting the flaw when developers patched it.
One affected Lightning node belonged to Foundation, a hardware-wallet manufacturer. During the August incident, the project said the issue did not expose standard on-chain wallets or its built-in hot wallets. The current reports instead concern funds held in those hot wallets.
BTCPay Server also issued an emergency version 2.4.7 update on October 29 to address security weaknesses. Developers have not linked the latest drains to a confirmed failure in that version. Their latest statement identifies reports involving version 2.4.1 and older installations.
This makes the new incident at least the second reported theft affecting outdated BTCPay Server deployments within three months. Investigators have not disclosed whether the attacks share the same technical cause.
BTCPay Server is a free, open-source tool that merchants can host to accept Bitcoin payments. Its hot-wallet option keeps signing keys on the server, allowing the software to send payments without separate hardware approval. That convenience also increases the impact of unauthorized administrator access.
Once attackers control a server holding those keys, they can move the funds. Cold storage instead keeps private keys offline. For merchants handling daily payments, the distinction matters because hot wallets can hold money intended for settlements and customer transactions.
Read More: BTCPay Restricts Remote LND Access After Critical Credential Theft
Dorier said he uses version 2.4.7 with a hot wallet, but cautioned operators against keeping large balances online. He advised users to limit hot-wallet funds to amounts they could afford to lose. The project has offered no guarantee against future incidents.
JAN3 chief executive Samson Mow proposed linking BTCPay payments to Aqua Bitcoin and moving funds to cold storage regularly. Meanwhile, operators may review balances, server logs, and transaction records for unusual activity. Those who suspect a compromise should avoid reusing exposed signing keys.
With the root cause still unknown, how can merchants retain fast Bitcoin payments without leaving substantial funds accessible through internet-connected servers?
BTCPay Server has linked reported hot-wallet drains to installations running version 2.4.1 or older, without confirming the intrusion method or losses. Operators face an immediate shutdown warning as investigators examine older flaws. Merchants can review wallet activity and keep large reserves offline.