BTCPay Server Hack: Merchants Told to Shut Down After Bitcoin Wallet Drains

BTCPay Server has warned merchants and other operators to shut down their self-hosted servers after receiving reports that attackers were draining Bitcoin from connected hot wallets.

The open-source Bitcoin payment platform issued the emergency warning on November 1, asking operators to take their BTCPay Server instances offline while its security team investigated the incident.

A subsequent update provided more information about the suspected attack. BTCPay Server said its investigation had identified an attack vector targeting instances running version 2.4.1 or older. The project also said it had no credible reports of hot-wallet drains affecting users running the latest version 2.4.7.

What Happened to BTCPay Server?

BTCPay Server received reports that unauthorized attackers were sweeping funds from hot wallets connected to some self-hosted instances.

A hot wallet is a cryptocurrency wallet that remains connected to the internet. BTCPay Server can use hot wallets to automatically process Bitcoin payments, allowing merchants to accept and manage cryptocurrency without relying on a third-party payment processor.

The same setup also creates a security risk.

If an attacker gains sufficient access to the merchant's server, the attacker may potentially gain access to wallet information and move cryptocurrency without the owner's direct approval.

BTCPay's own documentation warns that storing the wallet seed on the server has security implications because the server can automatically sign transactions.

BTCPay Asked Operators to Shut Down Their Servers

When the initial reports emerged, BTCPay Server issued a broad warning to operators.

The project instructed users to shut down their instances and keep them offline while the investigation was underway.

This was particularly important because BTCPay Server is designed around self-hosting. Unlike a traditional centralised payment processor, there is no single company-controlled switch that can instantly disable every merchant's installation.

Each business operates its own server and is responsible for maintaining and securing its installation.

That decentralised structure is one of BTCPay Server's major advantages, but it also means security incidents can require individual operators to take action.

Which BTCPay Server Versions Were Targeted?

The investigation later narrowed the suspected attack to older versions.

BTCPay Server said its incident-response investigation identified an attack vector targeting version 2.4.1, released in July 2026, and older versions.

The project also said it had no credible reports of hot-wallet drains involving the latest version 2.4.7.

BTCPay founder Nicolas Dorier said attackers appeared to have obtained administrator-level access on affected servers, although the exact method used to gain that access was still being investigated.

This means the incident should not be interpreted as evidence that every BTCPay Server installation was compromised.

Why Hot Wallets Can Be Risky

Hot wallets are designed for convenience.

Because they are connected to the internet, they can be used for transactions without requiring users to manually connect an offline wallet every time a payment needs to be processed.

For merchants, this can make Bitcoin payments much easier to automate.

However, internet connectivity also increases the potential attack surface.

If the server hosting a hot wallet is compromised, an attacker could potentially access sensitive wallet credentials or use the server's ability to sign transactions.

This is why cryptocurrency security experts generally recommend avoiding storing large amounts of cryptocurrency in hot wallets.

BTCPay founder Nicolas Dorier has also warned users not to keep more funds in a hot wallet than they are prepared to lose.

BTCPay Server Has Faced Another Security Incident This Year

The latest incident comes only months after another BTCPay Server security problem.

In August 2026, the project disclosed a vulnerability affecting versions before 2.4.2. That flaw allowed attackers to obtain credentials associated with LND, the Lightning Network implementation used by Bitcoin nodes.

Those credentials could potentially be used to gain control over connected Lightning funds.

BTCPay Server addressed that issue with version 2.4.2.

The latest incident appears to involve a different attack path, although investigators have identified traces associated with vulnerabilities predating the 2.4.2 release.

How Many Merchants Lost Bitcoin?

BTCPay Server has not publicly disclosed a confirmed total loss amount or the number of affected servers in the latest incident.

That makes it too early to determine the financial scale of the attack.

The fact that attackers were able to drain hot wallets is nevertheless significant because BTCPay Server is used by businesses that accept Bitcoin directly through their own infrastructure.

Investigators are continuing to examine the affected systems and transaction activity.

What Should BTCPay Server Operators Do?

Operators using older versions should treat the incident seriously.

The most important step is to determine which BTCPay Server version is running and follow the project's latest security guidance.

Operators should also review:

• Server administrator accounts
• Recent login activity
• Wallet transactions
• Wallet seed exposure
• Server logs
• Connected Lightning infrastructure
• Installed BTCPay Server version
• Unusual or unauthorised configuration changes

Merchants should also avoid assuming that simply restarting an affected server makes it safe.

Because the investigation concerns server compromise and wallet security, operators should follow BTCPay Server's current incident-response instructions before bringing affected systems back online.

BTCPay Server Hack Highlights the Risks of Self-Hosted Crypto Payments

The incident illustrates both the advantages and risks of self-hosted cryptocurrency payment systems.

BTCPay Server allows merchants to accept Bitcoin without handing custody of their funds to a traditional payment processor. Users retain greater control over their infrastructure and payment flow.

But that control also comes with responsibility.

Merchants must keep their servers updated, secure administrator accounts, monitor wallet activity and protect sensitive credentials.

The latest incident also shows why software updates are especially important when security vulnerabilities have already been addressed in newer releases.

For now, the investigation remains ongoing. BTCPay Server's latest public information indicates that the attack vector targeted version 2.4.1 and older, while the project reported no credible hot-wallet drains on version 2.4.7.

As investigators continue analysing the incident, merchants using BTCPay Server should monitor official security announcements and ensure their installations are running supported, up-to-date software.