BTCPay Tells Merchants to Switch Off Servers Amid Hot Wallet Attack Reports

What it is

On 1 November 2026, BTCPay Server told operators to shut down their instances after reports that attackers were sweeping hot wallets. BTCPay is a free, self-hosted tool for accepting Bitcoin payments. The project posted the shutdown request at 5:25 p.m. ET.

How it works

The page gives little mechanism. About two hours after the first post, founder Nicolas Dorier said the reports appeared to involve releases older than 2.4.2, and that the attacker had logged in to affected servers with administrator access. The project later said it had identified an attack vector against version 2.4.1 or older. How the attacker obtained administrator access is not stated.

A hot wallet keeps the wallet seed on the internet-connected server so it can sign transactions automatically. Anyone with control of the server can therefore move the funds. BTCPay's documentation labels the feature "DANGER" and warns that it "comes with security implications."

Preconditions / Affected

• Servers running BTCPay 2.4.1 (released 23 July 2026) or older were targeted.
• The funds at risk are those in hot wallets configured on the server.
• The project reports no credible drain reports for 2.4.7.
• Some hosting providers, including LunaNode, have shut down older BTCPay instances automatically.

What to do

Stop a running instance with the project's command:

./btcpay-down.sh

Update to 2.4.7 or later, which the project urges all operators to do. Version 2.4.7 was released on Thursday (29 October 2026) as an emergency update. It fixes one critical and several medium-severity vulnerabilities that BTCPay said were brought to its attention through Anthropic's frontier open-source software scanner. Affected users should send details and logs to the BTCPay security team.

Caveats

• BTCPay has not said whether the attacks used any of the flaws fixed in 2.4.7.
• It has not said how many servers were affected or how much Bitcoin was taken.
• The "no credible reports" statement for 2.4.7 is the project's own, and the investigation was still open.
• In August 2026, BTCPay warned that a critical flaw in all versions before 2.4.2 was being actively exploited. Supporters funded a bounty of 10% of any stolen funds returned, capped at 3 BTC.