BTCPay Server Hot Wallets Drained On Outdated Installations

BTCPay Server, an open-source cryptocurrency payment processor, warned users to shut down their payment servers after reports that attackers had gained unauthorized access to older installations and drained funds from connected Bitcoin hot wallets, according to Crypto.news. In a November 1, 2026 post on X, the project said it was receiving reports of hot wallets being swept by unauthorized attackers and asked operators to shut down instances using ./btcpay-down.sh until the investigation is complete. BleepingComputer reported that the unauthorized payments involved Bitcoin and Litecoin. According to Crypto.news, co-founder Nicolas Dorier said attackers managed to log in with administrator privileges on affected instances, and investigators have yet to determine how they obtained access. The project's investigation identified an attack vector affecting installations running version 2.4.1 (released July 23, 2026) or older. Dorier said there were clues that the attacker used vulnerabilities in versions earlier than 2.4.2, released August 7, according to BleepingComputer. Analytics Insight reported that the team has not said whether those flaws explain every reported theft. The scale of the losses is unknown. BTCPay Server has not disclosed the total amount stolen or the number of compromised servers, and the investigation is ongoing. No on-chain addresses or transaction hashes were provided in the source material, so the thefts cannot be independently verified here. The project has said it has no credible reports of hot wallet drains on the latest 2.4.7 release, and Dorier said the project's public servers running 2.4.7 were not attacked. Developers have not linked the drains to a confirmed failure in 2.4.7. The project asked VPS hosting providers to take affected instances offline as a precaution, and hosting providers including LunaNode shut down some installations, according to Crypto.news and BleepingComputer. Users who believe they were compromised were asked to send incident details and logs to the security team, and those who lost funds were asked to report to local authorities. The project strongly urged users to update to 2.4.7 and recommended that those on 2.4.1 or older take instances offline as soon as possible. No public timeline for the investigation has been given, and no recovery of stolen cryptocurrency has been announced. Operators of self-hosted payment software should keep it updated, subscribe to the project's security announcements, and apply emergency releases promptly. Anyone running BTCPay Server 2.4.1 or older should follow the project's guidance and take the instance offline until it is updated. Keep only the funds needed for operations in hot wallets, restrict and monitor administrator access, and retain server logs so they can be shared with the security team if a compromise is suspected. The incident follows other recent security events involving BTCPay Server. Analytics Insight reported an August attack on installations older than 2.4.2, which had a critical weakness allowing remote attackers to obtain Lightning Network credentials and drain connected wallets. BleepingComputer reported that on October 29 the company disclosed a critical vulnerability found via Anthropic's Frontier OSS scanner, prompting the emergency 2.4.7 release. The sources do not establish that these earlier events are connected to the November thefts.