Attackers gained admin access to outdated BTCPay Server instances and swept their hot wallets, and traces point to flaws that predate an August patch.
The damage falls on operators who never updated, and the team has yet to disclose the total losses. BTCPay Server is a free, open-source payment processor that merchants host themselves to accept Bitcoin. In a hot wallet setup, the server stores the private keys itself, which lets the software send funds without the operator signing each transaction. As a result, anyone with admin access to such a server can move its coins.
Which Versions Did the Attackers Target?
The BTCPay Server team first raised the alarm late on Nov. 1. It asked every operator to shut down their instance until the investigation ends.
A follow-up then narrowed the scope. The attack vector targets version 2.4.1, released on July 23, 2026, and anything older. Meanwhile, the team says it has no credible reports of drains on the current 2.4.7 release.
Founder Nicolas Dorier said the attacker logged in as an admin on the affected servers, though the team has not yet worked out how. So far, the investigation has found traces of vulnerabilities that predate version 2.4.2.
The breach marks at least the second time in three months that attackers have stolen funds from BTCPay Server instances running versions older than 2.4.2. That release patched a critical flaw in August, which let remote attackers grab Lightning node credentials and drain connected wallets.
Even then, the bug was already under active exploitation.
Is a BTCPay Server Hot Wallet Worth the Risk?
Hosting providers moved quickly as well. LunaNode and others may have shut down customer instances automatically to block attacks on older versions, the team says.
Dorier runs version 2.4.7 with a hot wallet himself. Still, the founder warned against keeping large sums on any server.
Don’t put more than you are ready to lose in hot wallet. We can’t guarantee it won’t happen again.
Nicolas Dorier, X
The incident fits a broader pattern across self-hosted Bitcoin infrastructure. Core Lightning recently warned that attackers target unpatched nodes. In both cases, the fix existed before the theft, so the weakest point was an operator who installed a BTCPay Server instance once and never updated it.
