BTCPay Tells Merchants to Switch Off Servers Amid Hot Wallet Attack Reports

BTCPay Server told operators to shut down their instances on Sunday after reports that attackers were sweeping hot wallets on servers running the self-hosted Bitcoin payment software. BTCPay founder Nicolas Dorier and the project later said the attack vector targeted version 2.4.1, released July 23, or older, and that there were no credible reports of hot wallet drains among users running the latest 2.4.7 release, which shipped Thursday as an emergency update fixing one critical and several medium-severity vulnerabilities found by Anthropic's frontier open-source software scanner. Some hosting providers, including LunaNode, shut down BTCPay instances automatically, and BTCPay has not said how many servers were affected or how much Bitcoin was taken.

In brief - BTCPay Server urged operators to shut down their instances on Sunday after reports that attackers were sweeping hot wallets on servers running the software. - The project later said the attack targeted versions 2.4.1 or older, and that it had no credible reports of drains among users running the latest 2.4.7 release. - BTCPay released 2.4.7 on Thursday as an emergency update fixing one critical and several medium-severity vulnerabilities found by Anthropic's scanner. BTCPay Server, a free, open-source tool businesses use to accept Bitcoin https://decrypt.co/?post type=post&p=5736 payments, told operators to switch off their servers on Sunday after reports that attackers were draining the hot wallets https://decrypt.co/?post type=post&p=5702 connected to them. "We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers," the project tweeted https://twitter.com/BtcpayServer/status/2117020340815819262 at 5:25 p.m. ET. "If you're running an instance, please shut it down ./btcpay-down.sh until we complete the investigation." 🚨 We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers. If you're running an instance, please shut it down ./btcpay-down.sh until we complete the investigation. — BTCPay Server @BtcpayServer November 1, 2026 https://x.com/BtcpayServer/status/2117020340815819262?ref src=twsrc%5Etfw About two hours later, BTCPay founder Nicolas Dorier said https://twitter.com/NicolasDorier/status/2117051298633900041 the reports appeared to involve releases older than version 2.4.2, and that the attacker had logged in to affected servers with administrator access. Later on Sunday, the project said https://twitter.com/BtcpayServer/status/2117106238123123008 its investigation had identified an attack vector targeting instances running version 2.4.1, released on July 23, or older. "We have no credible reports of hot wallet drains for users running the latest 2.4.7 release," it said, urging everyone to keep their software updated and asking affected users to send details and logs to its security team. Some hosting providers, including LunaNode, have shut down https://twitter.com/BtcpayServer/status/2117106240098611681 BTCPay instances automatically to stop older versions from being exploited, the project said. BTCPay has not said how many servers were affected or how much Bitcoin was taken. Hot wallets and BTCPay's emergency update Because BTCPay is self-hosted, each merchant runs the software on their own server, and there is no central operator that can switch instances off. Merchants can choose to run a hot wallet, which stores the wallet's seed on that internet-connected server so it can sign transactions automatically. BTCPay's own documentation https://docs.btcpayserver.org/Wallet/ signing-with-a-hot-wallet labels the feature "DANGER" and warns that it "comes with security implications." The attacks come days after BTCPay released https://twitter.com/BtcpayServer/status/2115835402536079674 version 2.4.7 on Thursday as an emergency update fixing one critical and several medium-severity vulnerabilities, which it said were brought to its attention through Anthropic's frontier open-source software scanner. BTCPay has not said whether the attacks exploited any of those flaws. It is not the first security scare for the project this year. In August, BTCPay warned https://decrypt.co/375159/bitcoin-payment-service-btcpay-critical-flaw-active-attack that a critical vulnerability in all versions before 2.4.2 was being actively exploited, and told users to update or shut down their servers. Supporters of the project later funded https://decrypt.co/375376/btcpay-bitcoin-bounty-critical-wallet-exploit a recovery bounty of 10% of any stolen funds returned, capped at 3 BTC. Daily Debrief Newsletter Start every day with the top news stories right now, plus original features, a podcast, videos and more. Join 72,000+ readers Add on Google https://www.google.com/preferences/source?q=decrypt.co