In brief
- BTCPay Server urged operators to shut down their instances on Sunday after reports that attackers were sweeping hot wallets on servers running the software.
- The project later said the attack targeted versions 2.4.1 or older, and that it had no credible reports of drains among users running the latest 2.4.7 release.
- BTCPay released 2.4.7 on Thursday as an emergency update fixing one critical and several medium-severity vulnerabilities found by Anthropic's scanner.
BTCPay Server, a free, open-source tool businesses use to accept Bitcoin payments, told operators to switch off their servers on Sunday after reports that attackers were draining the hot wallets connected to them.
"We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers," the project tweeted at 5:25 p.m. ET. "If you're running an instance, please shut it down (./btcpay-down.sh) until we complete the investigation."
🚨 We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers.
If you're running an instance, please shut it down (./btcpay-down.sh) until we complete the investigation.
— BTCPay Server (@BtcpayServer) [November 1, 2026](https://x.com/BtcpayServer/status/2117020340815819262?ref_src=twsrc%5Etfw)
About two hours later, BTCPay founder Nicolas Dorier said the reports appeared to involve releases older than version 2.4.2, and that the attacker had logged in to affected servers with administrator access.
Later on Sunday, the project said its investigation had identified an attack vector targeting instances running version 2.4.1, released on July 23, or older. "We have no credible reports of hot wallet drains for users running the latest 2.4.7 release," it said, urging everyone to keep their software updated and asking affected users to send details and logs to its security team.
Some hosting providers, including LunaNode, have shut down BTCPay instances automatically to stop older versions from being exploited, the project said. BTCPay has not said how many servers were affected or how much Bitcoin was taken.
Hot wallets and BTCPay's emergency update #
Because BTCPay is self-hosted, each merchant runs the software on their own server, and there is no central operator that can switch instances off. Merchants can choose to run a hot wallet, which stores the wallet's seed on that internet-connected server so it can sign transactions automatically. BTCPay's own documentation labels the feature "DANGER" and warns that it "comes with security implications."
The attacks come days after BTCPay released version 2.4.7 on Thursday as an emergency update fixing one critical and several medium-severity vulnerabilities, which it said were brought to its attention through Anthropic's frontier open-source software scanner. BTCPay has not said whether the attacks exploited any of those flaws.
It is not the first security scare for the project this year. In August, BTCPay warned that a critical vulnerability in all versions before 2.4.2 was being actively exploited, and told users to update or shut down their servers. Supporters of the project later funded a recovery bounty of 10% of any stolen funds returned, capped at 3 BTC.
Daily Debrief Newsletter #
Start every day with the top news stories right now, plus original features, a podcast, videos and more.
Join 72,000+ readers