BTCPay Server Says Hot-Wallet Drains Hit Servers Running Version 2.4.1 or Older
The open-source bitcoin payment tool told merchants to shut down on Sunday. By night it had traced the attacks to old software and had no credible reports of drains on 2.4.7.
Update, Nov. 3, 2026: BTCPay Server has since told merchants whose servers were compromised to rebuild on a fresh machine with a new wallet. Updating to version 2.4.7 alone is not enough for those servers. Read our follow-up and BTCPay's incident post.
BTCPay Server, the free software many merchants run to accept bitcoin, told its users to switch off their servers on Sunday. "We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers," the project posted on X at 4:25 p.m. CT. It asked anyone running an instance to shut it down until the investigation was done.
🚨 We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers.
If you're running an instance, please shut it down (./btcpay-down.sh) until we complete the investigation.
By 10:07 p.m. CT the picture was narrower. In a follow-up post, the project said it had found an attack vector aimed at servers running version 2.4.1, from July 23, or older. It said it has "no credible reports of hot wallet drains" on the current 2.4.7 release. It again urged everyone to keep their server updated.
📢 Our incident response investigation identified an attack vector targeting instances running versions 2.4.1 (Jul 23, 2026) or older.
We have no credible reports of hot wallet drains for users running the latest 2.4.7 release. We again urge everyone to keep their BTCPay Server… pic.twitter.com/gYxK4Bb7fc
BTCPay is self-hosted. Each merchant runs a copy on their own server, so there's no central company holding customer funds. That also means there's no master switch. The project can only ask operators to act.
Fueled Crypto Daily
Get the news, explained, by email.
The problem is the hot wallet. In that mode, the keys that sign payments sit on the server itself. That's handy for refunds and payouts. But anyone who controls the server can move the coins too. That's why the first alert was so blunt. As The Defiant pointed out, it named no affected versions and no patch at first. Operators were told to run the shutdown script and wait.
Founder Nicolas Dorier said the attacker "managed to log in as admin" on the affected servers. The team is still working out how. He later wrote that the team has "traces that pre 2.4.2 vulnerabilities were used." Some hosting providers shut older instances down on their own. BTCPay thanked LunaNode and others for moving quickly.
We will publish a blog post going to more details.
But at least for those who already updated at least once since the release of 2.4.2, there is no reason to panic.
According to BTCPay's GitHub release log, version 2.4.1 shipped July 23. Version 2.4.2 followed on Aug. 7. Its security advisory fixed a critical flaw that attackers had already exploited to take Lightning node credentials. At the time, BTCPay said on-chain hot wallets were not affected by that flaw. The project hasn't said which older weakness was used this time.
The newest release, 2.4.7, came out Oct. 29. Its notes say it fixes 85 security findings reported through Anthropic's OSS Scanner program, including one rated critical.
How much is missing
BTCPay hasn't given a loss figure or a count of affected stores. Dorier did publish a bitcoin address he identified as the attacker's. On mempool.space, that address had received about 19.8 BTC across roughly 640 incoming payments by early Monday CT. Most of it had already moved on. That's our read of public data, not a confirmed loss. Received isn't the same as stolen. He also named a Litecoin address.
What operators should do now
BTCPay's guidance is simple. Check your version. Anything at 2.4.1 or older should stay offline until it's updated to 2.4.7. If you were hit, the project asks for details and logs at security@btcpayserver.org. Dorier's advice: "don't keep too much in your Hot Wallet." If a server was drained, he wrote, "Not only the seed, they should consider the server cooked." In other words, rebuild it. Don't just swap the wallet.
For your personal holdings, the rule doesn't change. Never store seed phrases or private keys in a password manager or on a computer, phone or other electronic device. Keep them offline on paper or metal. A merchant hot wallet breaks that rule by design, which is why it should hold only small amounts. Our hot vs. cold wallet guide explains the trade-off. If you lost funds, start with what to do if your crypto is stolen.
The French bank says attackers used its own account, not customer accounts. It validates the order of magnitude of reported losses, not a final figure.
The exchange's first incident report describes a months-long campaign. It ran through a tampered download, a rigged coding assignment and an abused internal AI tool.
