BTCPay Server warns of reported hot-wallet drains, urges shutdowns
BTCPay Server has urged operators to temporarily shut down their instances after reports that attackers gained administrator access to older installations and drained connected Bitcoin hot wallets. The project suspects installations running version 2.4.1 or earlier may be affected, but the attack method and scale of the losses remain unknown.
- Initial guidance urged operators to shut down their instances.
- Installations on version 2.4.1 or earlier may be affected.
- BTCPay Server reports no credible drains involving version 2.4.7.
- The number of compromised servers and funds lost remains unknown.
What operators know and what remains unclear
BTCPay Server’s security alert was dated November 2, but did not specify the year. The project lists version 2.4.1 as released on July 23, 2026. Without the alert’s year, the dates do not establish the chronology.
The initial warning urged operators to take their instances offline while the team investigated. BTCPay Server later identified a suspected attack vector affecting installations on version 2.4.1 or earlier. Co-founder Nicolas Dorier said the affected installations appeared to be running releases from before version 2.4.2, and that attackers had logged in with administrator privileges.
That does not mean every installation in the suspected version range was compromised. The project also has not publicly explained the technical weakness or how attackers gained administrator access. The version range is a warning, not a confirmed list of victims.
BTCPay Server recommended temporarily shutting down instances with ./btcpay-down.sh. Operators who suspect a compromise were asked to send incident details and relevant server logs to [email protected]. The initial shutdown request applied broadly, while the later assessment narrowed the suspected version range. The project has not publicly announced an all-clear.
BTCPay Server said it had received no credible reports of hot-wallet drains involving version 2.4.7. Dorier also said the project’s public servers, which ran that version, had not been attacked. Those statements are useful but limited. They do not establish that every 2.4.7 installation is safe under every configuration, or that older installations were necessarily breached.
The scale and wallet exposure are still unknown
BTCPay Server has not disclosed how many servers were compromised, how many users reported losses, or how much cryptocurrency was stolen. It has announced no recovery of funds and has provided no public timeline for completing the investigation.
Some hosting providers took precautions. LunaNode shut down instances, and BTCPay Server thanked providers that acted on its warning. The project has not published a complete list of providers that suspended instances or the number of systems taken offline.
Reports describe attackers draining connected hot wallets, but a server breach does not automatically expose every wallet connected to it. The risk depends on how a merchant configured the wallet and where the relevant keys or credentials are stored. BTCPay Server has not publicly detailed the compromised wallet setups.
Self-hosting means taking security seriously
BTCPay Server is a self-hosted payment processor that lets merchants accept Bitcoin without relying on a conventional payment intermediary. Operators get more control, but they are also responsible for server administration, software updates and wallet configuration.
A hot wallet connects to online systems, making it practical for regular transactions but potentially vulnerable if the systems or credentials controlling it are compromised. Cold storage keeps private keys offline, reducing online exposure. BTCPay Server recommended keeping only limited funds in hot wallets and moving excess funds to cold storage.
Cold storage is no magic shield. It comes with its own operational responsibilities. But keeping large balances on an internet-connected system can make a server compromise costly. The right balance depends on how funds are used and secured.
Not the same as the earlier Lightning-wallet vulnerability
This investigation is separate from a vulnerability BTCPay Server disclosed in August. That earlier issue involved LND administrator macaroon credentials and access to connected Lightning wallets. The project said the flaw did not compromise ordinary on-chain wallets, including hot wallets.
For the earlier incident, BTCPay Server announced a recovery bounty equal to 10% of recovered funds, capped at 3 BTC if all stolen assets were retrieved. The BTCPay Server Foundation also committed 0.21 BTC each to Sparrow Wallet developer Craig Raw and the Bitcoin Red Team fund for discovering and reporting the vulnerability.
Core Lightning separately warned in September about attacks targeting older, unpatched Lightning nodes, but had not established whether those attempts led to stolen funds. These separate incidents do not establish a coordinated campaign. They do underline a basic reality of self-hosting: control comes with security responsibilities.
Key questions and answers
-
Which BTCPay Server versions are suspected to be affected?
The suspected range is version 2.4.1 or earlier. That does not mean every installation in that range was compromised.
-
What should operators do?
BTCPay Server’s initial alert urged operators to shut down instances using ./btcpay-down.sh. Operators who suspect an incident should send details and relevant logs to [email protected].
-
Were credible drains reported on version 2.4.7?
BTCPay Server said it had received no credible reports of hot-wallet drains involving version 2.4.7. It also said its own public servers running that version had not been attacked.
-
How many servers or how much bitcoin was affected?
BTCPay Server has not disclosed the number of compromised servers or the amount stolen. It has announced no recovery of funds.
