BTCPay Server posted an urgent warning on Nov. 1, 2026, reporting that attackers were sweeping bitcoin from hot wallets attached to self‑hosted payment servers. Operators were instructed to shut down their instances using the ./btcpay-down.sh command until the cause could be determined.
Version vulnerability identified
Founder Nicolas Dorier said preliminary analysis points to deployments running software versions prior to 2.4.2. Forensic traces suggest the attackers obtained administrator access through vulnerabilities present in those older releases. Public and demonstration servers running version 2.4.7 were not reported as compromised.
Recent security overhaul
Two days earlier, on Oct. 29, BTCPay Server released version 2.4.7 after an AI‑assisted scan by Anthropic identified 85 security findings, including one critical and several high‑severity issues. The release addressed those findings, but the warning indicates that many operators have not yet upgraded.
Impact on merchants
Merchants, including Coincards, have taken their BTCPay installations offline following the alert. The shutdown creates a trade‑off between maintaining payment availability and protecting funds stored in hot wallets. Dorier emphasized limiting hot‑wallet balances to amounts that operators can afford to lose.
Ongoing investigation
Developers have not disclosed the total amount of bitcoin stolen or the number of affected merchants. No specific incident‑related patch has been announced, and a full technical report is pending.
