If you run a $Bitcoin payment server, stop reading after this sentence and go switch it off. BTCPay Server, the most widely used self-hosted Bitcoin payment processor, has confirmed that attackers are sweeping hot wallets on older installations and has asked every operator to take their instance offline until the investigation is complete.
What happened to BTCPay Server?
Late on Saturday, 1 November, the BTCPay Server team posted an emergency alert: it was receiving reports of hot wallets connected to BTCPay instances being emptied by unauthorized attackers. The instruction was blunt. Shut your server down with the ./btcpay-down.sh script and wait.
By Sunday, the incident response team had narrowed the attack vector. According to the project, the affected installations run version 2.4.1, released on 23 July 2026, or older. There are no credible reports of drained wallets on the current 2.4.7 release.
Co-founder Nicolas Dorier added a worrying detail: the attacker managed to log in to the affected instances with administrator privileges. How that access was obtained is still unknown. The project’s own public servers, which run 2.4.7, were not hit.
How many Bitcoin were stolen in the BTCPay hack?
Nobody knows yet, and BTCPay Server has not published a figure. The team has not disclosed how many servers were compromised or how many operators have reported losses. Affected users are being asked to send incident details and server logs to the security team so the investigation can establish the scale.
Hosting providers moved fast. LunaNode and others began shutting down older instances automatically, so if your BTCPay dashboard suddenly went dark over the weekend, that may be why.
Is this the same BTCPay vulnerability as in August?
Not exactly, but the pattern is familiar. In August, BTCPay Server warned of an actively exploited flaw that let attackers lift LND administrator credentials and reach connected Lightning wallets. That bug was patched in 2.4.2, and the project put up a recovery bounty of 10 percent of recovered funds, capped at 3 BTC.
The August flaw explicitly did not touch on-chain hot wallets. This one does. And it comes six weeks after Core Lightning warned that attackers were hunting older, unpatched Lightning nodes. The message from three separate incidents in three months is the same: Bitcoin payment infrastructure that is not updated is being actively scanned and attacked.
What should BTCPay Server operators do right now?
- Shut the instance down until BTCPay Server gives the all clear, even if you are on a recent version. The project says 2.4.7 is not affected, but the root cause of the admin login is unknown.
- Check your hot wallet balances and move whatever is left into cold storage. BTCPay has long recommended keeping only operating float in a hot wallet.
- Preserve your logs. If you see unexplained transactions, do not wipe the server. Send the logs to BTCPay’s security team.
- Update before you restart. When you bring the instance back, do it on 2.4.7 or whatever patched release follows.
- Rotate credentials for every admin account on the server, and for any service that shared a password with it.