BTCPay Server issued a security alert on November 2, urging operators of its self‑hosted Bitcoin payment processor to shut down their instances after reports of attackers draining funds from connected hot wallets.
Scope of the advisory
The warning initially applied to all users, but the project later clarified that the suspected attack vector targets installations running version 2.4.1, released on July 23, 2026, or older. No credible reports of hot‑wallet drains have been received for the latest release, version 2.4.7.
Details of the intrusion
Co‑founder Nicolas Dorier said attackers were able to log in with administrator privileges on the affected instances, though the method of obtaining that access remains under investigation. The public servers running version 2.4.7 have not been compromised.
Response actions
Operators are instructed to temporarily disable their servers using the ./btcpay-down.sh script. Hosting providers, including LunaNode, have already shut down some installations as a precaution. Affected users are asked to submit incident details and server logs to [email protected].
Recommendations
- Keep software updated to the latest version.
- Limit the amount of Bitcoin stored in hot wallets.
- Transfer excess funds to cold storage where private keys are offline.
The project has not disclosed the amount of cryptocurrency stolen or the number of compromised servers, and no timeline for the investigation’s conclusion has been provided.
