BTCPay Server Hot Wallet Thefts Traced to Releases 2.4.1 and Older

By Coinvote

Published November 2, 2026 - 15:22 UTC | 4 mins read

BTCPay Server told merchants to shut down their self-hosted instances after reports of swept hot wallets, then tied the attacks to version 2.4.1 and older. The project has not said how many servers were hit or how much Bitcoin was stolen.

Merchants told to power down after wallet sweeps

BTCPay Server, the free open-source software that businesses use to accept Bitcoin payments, told operators on Sunday to shut down their servers. Decrypt reported that the project posted the warning at 5:25 p.m. ET, saying it was receiving reports of hot wallets being swept by unauthorized attackers. It asked operators to run the ./btcpay-down.sh script and keep the instance offline until its investigation was complete.

According to Decrypt, BTCPay founder Nicolas Dorier commented roughly two hours afterward, saying the incidents seemed tied to builds predating 2.4.2. He also said the attacker had signed in to the affected servers holding administrator-level access. CoinDesk described the same remarks and noted that the project was still investigating and had given neither a loss figure nor a fix at that point.

The investigation narrows to version 2.4.1 and earlier

The project later reported that its investigation had found a way in aimed at servers on version 2.4.1 or earlier; the 2.4.1 build came out on July 23. It added that it knew of no credible drain reports from anyone on the newest release, 2.4.7, and urged everyone to update. Affected users were asked to send details and logs to the security team. The Defiant summarised the same finding in its headline and summary.

Hosting companies also stepped in. Decrypt reported that providers including LunaNode automatically shut down BTCPay instances to stop older versions from being exploited, according to the project.

Why a self-hosted payment tool cannot be switched off centrally

Each merchant runs BTCPay on their own server, so no central operator can disable instances. That is why the project relied on a public call for operators to act themselves. Decrypt noted that this structure leaves the shutdown in the hands of individual merchants.

The exposure comes from the hot wallet option. A merchant who enables it keeps the wallet's seed on the internet-connected server so that the software can sign transactions automatically. In general, anyone who gains control of such a server can reach the keys stored on it. BTCPay's own documentation labels the feature "DANGER" and warns that it carries security implications.

What is established and what is still missing

The public record is thin on the scale of the incident. Cointelegraph reported that BTCPay has not revealed how many operators were hit, what the stolen funds were worth, or how attackers got into the wallets. The outlet said it had contacted the project for comment and received no reply before publication.

Affected: instances running version 2.4.1 or older, per the project's findings.
Not reported affected: users on version 2.4.7, where the project said it had no credible reports of drains.
Not disclosed: the number of operators hit, the amount of Bitcoin taken, and the method of access.
Requested: details and logs from anyone affected, sent to the BTCPay security team.

How the outlets' accounts compare

The reports agree on the core facts but differ in timing and detail. Decrypt placed the project's version finding late on Sunday, while Cointelegraph dated it to Monday. Only Decrypt reported the administrator-login detail, the LunaNode shutdowns and the exact time of the first warning. Cointelegraph alone gave the July 23, 2026 release date for version 2.4.1 in full. CoinDesk and The Defiant were available only through their headlines and summaries, which match the other two outlets on the key points.

Decrypt also recalled that BTCPay shipped version 2.4.7 on Thursday as an emergency update. The release fixed one critical and several medium-severity vulnerabilities that the project said Anthropic's frontier open-source software scanner had flagged. BTCPay has not said whether the Sunday attacks used any of those flaws.

A second security scare in a few months

The incident follows an earlier one. According to Decrypt, BTCPay warned in August of a critical flaw affecting every release prior to 2.4.2 that attackers were exploiting, and it told users to update or shut down. Project supporters afterwards paid for a bounty offering 10% of any stolen funds that were returned, up to a ceiling of 3 BTC.

Cointelegraph added that the project restricted remote Lightning access after that attack, which exploited a vulnerability to obtain Lightning Network Daemon credentials and steal funds. Dorier's 2.4.2 threshold matches the version boundary in the August warning. No outlet says the two episodes are connected, and Cointelegraph stated that it remains unclear.

What operators and observers should check next

Operators can confirm which version their server runs and compare it with the 2.4.1 cutoff and the 2.4.7 release the project points to. Anyone who ran an older version with a hot wallet enabled can send logs to the security team, as requested. Some hosted instances may already have been taken offline by providers.

Several questions remain open. The project has not published a loss figure, an account of how the administrator access was obtained, or a statement on whether the flaws fixed in 2.4.7 played any part. Whether the August vulnerability and this attack vector are related is also unresolved.

Market snapshot

Asset	Price	24h	7d	Market cap
Bitcoin (BTC)	$77,922	-0.1%	-2.4%	$1.57 trillion

CoinGecko data as of 2026-11-02 (UTC).

FAQ

Which BTCPay Server versions were targeted in the hot wallet attacks?

BTCPay said its investigation found an attack vector aimed at instances running version 2.4.1, released on July 23, or older. It added that it knew of no credible drain reports from anyone on the newest release, 2.4.7.

How much Bitcoin was stolen from BTCPay Server users?

The amount has not been disclosed. Cointelegraph reported that BTCPay has not said how many operators were affected or what the stolen funds were worth, and CoinDesk noted that the project had not given a loss figure.

Why could BTCPay not shut down affected servers itself?

BTCPay is self-hosted, so each merchant runs it on their own server and no central operator controls the instances. The project could only ask operators to shut down, although some hosting providers such as LunaNode switched off older instances automatically.