BTCPay Server hack: attackers drain hot wallets on versions 2.4.1 and older

Attackers are emptying hot wallets on self-hosted BTCPay Server instances, the open-source tool merchants use to accept bitcoin. Late on Sunday 1 November the project wrote on X: "We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers." It asked every operator to run ./btcpay-down.sh and keep the server off until the investigation ends, CoinDesk reported.

BTCPay has not disclosed how much was stolen or how many servers were hit. On Monday the team said the BTCPay Server hack so far touches only old releases.

Which versions

• Affected: 2.4.1, released on 23 July 2026, and older.
• Not affected so far: the current 2.4.7, with "no credible reports of hot wallet drains" from its users.
• The project's own public servers run 2.4.7, and co-founder Nicolas Dorier says they were not attacked.

Dorier said the attacker logged in to the affected servers as an administrator. The team does not yet know how the attacker got that access and has not published a technical explanation. Some hosting providers, including LunaNode, switched off customer instances on old versions themselves, so your hosted server may already be offline.

Why a hot wallet is exposed

A BTCPay hot wallet keeps its seed phrase on the server, so the software can sign payments automatically. BTCPay's own documentation marks this mode "DANGER". Whoever gets admin access to the server can send the coins anywhere.

Each merchant runs their own server, and the team cannot switch any of them off remotely.

Second time since August

In August BTCPay fixed a different flaw in version 2.4.2. Attackers could pull LND credential files from servers without logging in and take over the merchant's Lightning node. The team confirmed thefts then too and told operators to update or shut down.

By our count, the servers drained this weekend had skipped that critical update for almost three months, and five releases have shipped since 2.4.2. Both attacks hit operators who did not update. BTCPay has not said whether the two share a cause.

“Don't put more than you are ready to lose in hot wallet. We can't guarantee it won't happen again.”

— Nicolas Dorier, co-founder of BTCPay Server, on X · crypto.news

What to do if you run BTCPay

• Check your version. On 2.4.1 or older, shut the server down with ./btcpay-down.sh.
• Keep the logs and send details of any loss to the BTCPay security contact.
• Hold in the hot wallet only what you need for refunds and payouts, and move the rest to cold storage.

The attack came three days after the Binance hack, where attackers also went after a hot wallet, through the system that signs withdrawals. To keep keys away from internet-connected machines, read our guide on how to protect your wallet.

The investigation is ongoing; BTCPay has not published a root cause or a loss figure.