Attackers gained admin access to outdated BTCPay Server instances and drained their hot wallets, according to the project, in an incident that has prompted an investigation into vulnerabilities that predate an August patch.
The damage falls on operators who did not update their software. The BTCPay Server team has not yet disclosed total losses.
BTCPay Server is a free, open-source payment processor that merchants host themselves to accept Bitcoin. In a hot wallet setup, the server stores the private keys itself, allowing the software to send funds without the operator signing each transaction. As a result, anyone with admin access to such a server can move its coins.
Which versions were targeted?
The BTCPay Server team first raised the alarm late on Nov. 1 and asked every operator to shut down their instance until the investigation ends.
A follow-up narrowed the scope. The attack vector targets version 2.4.1, released on July 23, 2026, and anything older. The team says it has no credible reports of drains on the current 2.4.7 release.
Founder Nicolas Dorier said the attacker logged in as an admin on the affected servers, though the team has not yet worked out how. So far, the investigation has found traces of vulnerabilities that predate version 2.4.2.
The breach marks at least the second time in three months that attackers have stolen funds from BTCPay Server instances running versions older than 2.4.2. That release patched a critical flaw in August that let remote attackers obtain Lightning node credentials and drain connected wallets. Even then, the bug was already under active exploitation.
Is a BTCPay Server hot wallet worth the risk?
Hosting providers moved quickly as well. LunaNode and others may have shut down customer instances automatically to block attacks on older versions, the team says.
Dorier runs version 2.4.7 with a hot wallet himself. Still, the founder warned against keeping large sums on any server.
“Don’t put more than you are ready to lose in hot wallet. We can’t guarantee it won’t happen again.”
The incident fits a broader pattern across self-hosted Bitcoin infrastructure. Core Lightning recently warned that attackers target unpatched nodes. In both cases, the fix existed before the theft, so the weakest point was an operator who installed a BTCPay Server instance once and never updated it.
