In this article5 sections
BTCPay Server, the free open-source software businesses use to accept Bitcoin, told operators on Sunday to shut down their instances after reports that attackers were emptying hot wallets on affected servers, Decrypt reported. The project posted the warning at 5:25 p.m. ET on November 1, 2026, saying it was receiving reports of hot wallets being swept and asking operators to run its shutdown script until an investigation was complete.
About two hours later, founder Nicolas Dorier said the reports appeared to involve releases older than version 2.4.2 and that the attacker had signed in to affected servers with administrator access. The project then said its investigation had identified an attack vector aimed at instances running version 2.4.1, released on July 23, or older, according to its follow-up update.
Also read: Dormant 2013 Bitcoin Wallet Moves $33.4 Million
Key facts
- BTCPay Server issued its shutdown warning on Sunday, November 1, 2026, at 5:25 p.m. ET.
- The project said the attack vector targeted version 2.4.1, released July 23, or older.
- BTCPay released version 2.4.7 on Thursday as an emergency update fixing one critical and several medium-severity vulnerabilities.
- The flaws in 2.4.7 were surfaced through Anthropic’s frontier open-source software scanner.
- Some hosts, including LunaNode, automatically shut down BTCPay instances to stop older versions from being exploited.
Self-hosted software with no central off switch
Because BTCPay is self-hosted, every merchant runs it on their own server and no central operator can disable instances for them. That is why the project resorted to a public call for operators to act themselves.
The risk centers on the optional hot wallet setup, in which a merchant’s seed is stored on the internet-connected server so it can sign transactions automatically. BTCPay’s own wallet documentation labels the feature “DANGER” and warns that it carries security implications. The project said it had no credible reports of hot wallet drains among users running the latest 2.4.7 release, and it asked anyone affected to send details and logs to its security team.
The emergency update shipped days before the reports surfaced. BTCPay has not said whether the attacks exploited any of the flaws that 2.4.7 fixed, and it has not disclosed how many servers were hit or how much Bitcoin was taken.
A repeat of August’s warning
This is the second security scare for the project this year. In August, BTCPay warned that a critical vulnerability in all versions before 2.4.2 was being actively exploited and told users to update or shut down. Supporters later funded a recovery bounty equal to 10% of any stolen funds returned, capped at 3 BTC. The latest incident again points operators toward the same remedy the project has stressed all year: run current software.
Why it matters
Merchants who accept Bitcoin without a custodial processor depend on BTCPay and similar tools to hold and move funds themselves, so a flaw that exposes hot wallets puts business revenue directly at risk. The episode also shows how quickly a self-hosted project must rely on voluntary compliance, since the only lever it has is telling operators what to do. For merchants, the practical contrast is between automated hot wallets and setups that keep keys offline.
What to watch
The next signals are BTCPay’s investigation findings, including whether the drains trace back to the vulnerabilities fixed in 2.4.7, and any disclosure of affected server counts or stolen Bitcoin. The project has asked affected operators to submit logs, which may shape that account.
Reported by Decrypt.
Source: Decrypt