The Crypto GuideStart learning
Menu
Prices: CoinGecko

Security & Scams

Bitcoin payment tool BTCPay Server warns of drained hot wallets on older versions

On November 1, BTCPay Server told operators to shut down their servers after reports of drained hot wallets. Its investigation points to versions 2.4.1 and older. What happened and what it means for you.

By Beginner5 min readPublished November 2, 202612 sources
On this page
  1. What happened
  2. Which versions are affected
  3. What isn't known yet
  4. What it means for you
  5. The takeaway

Key takeaways

  • On Sunday, November 1, 2026, BTCPay Server, free software that businesses run themselves to accept bitcoin, asked everyone running it to shut their servers down after reports that attackers were emptying the hot wallets on some of them.
  • Hours later, the project said its investigation had found an attack route aimed at servers on version 2.4.1 (released July 23, 2026) or older, and that it had no credible reports of drains on the current 2.4.7 release.
  • BTCPay hasn't said how much was taken or how many servers were hit. Its founder Nicolas Dorier said the attacker got into the affected servers with an administrator account, and the team was still working out how.
  • If you run BTCPay Server, update it before turning it back on, and keep only a small working balance in its hot wallet. If you only paid a shop through it, BTCPay's warnings so far are aimed at server operators, not customers.

BTCPay Server is free software that many online shops use to take bitcoin payments. On Sunday the project told everyone who runs it to switch it off. Here's what happened, who it affects, and the wallet lesson for everyone else.

What happened

At about 5:25 p.m. Eastern on Sunday, November 1, 2026, BTCPay Server posted an alert on X. It said it was getting reports that the hot wallets on some BTCPay servers were being "swept by unauthorized attackers", meaning emptied in one go. It asked anyone running the software to shut it down with its stop command, ./btcpay-down.sh, until the investigation was finished.

BTCPay Server is free, open-source software. Businesses install it on their own server and get paid in bitcoin straight into their own wallet, with no payment company holding the money in between. As CoinDesk pointed out, that design has a downside in an emergency: there's no central switch, so the project can only ask each operator to act.

About two hours later, BTCPay founder Nicolas Dorier said BTCPay's public servers, on version 2.4.7, "were not attacked." He said the reports appeared to involve versions older than 2.4.2, and that the attacker had managed to get into the affected servers with an administrator account. How they got that access was still being worked out. Later that night he added that the team had found traces of vulnerabilities from before 2.4.2 being used.

Which versions are affected

Just after 11 p.m. Eastern, BTCPay posted an update. Its incident response, it said, had identified an attack route aimed at servers on version 2.4.1, released July 23, 2026, or anything older. It said it had no credible reports of drained hot wallets on the newest release, 2.4.7, which came out on October 29, and again urged everyone to keep their servers updated.

Dorier's message to operators was that anyone who has updated at least once since 2.4.2 came out has "no reason to panic." Version 2.4.2 was released on August 7, 2026. He also told people to update often and not to keep much in a hot wallet. Replying to one user, he said operators who were hit should consider the whole server compromised, not only the wallet's seed phrase.

BTCPay also said some hosting companies switched off customers' servers on their own to stop older versions being exploited. If your store went offline overnight, that may be why.

What isn't known yet

  • How much was taken. BTCPay hasn't given a loss figure or a count of affected servers, according to both CoinDesk and Cointelegraph.
  • Exactly how the attacker got in. BTCPay has named the affected versions but hasn't published technical details. Dorier said a blog post with more information is coming.
  • Whether it's linked to August. In August, BTCPay fixed a critical flaw in 2.4.2 that let outsiders grab login credentials for Lightning nodes (LND) and steal funds. Its advisory at the time said the built-in hot wallets weren't affected. Cointelegraph notes it's unclear whether the new attack route is connected.

What it means for you

  • If you run BTCPay Server: BTCPay asked operators to keep servers shut down until its investigation is complete, and urges everyone to run the latest release (2.4.7 as of November 2). After updating, check the version shown in the admin footer. If your hot wallet was emptied, BTCPay asks you to send details and logs to security@btcpayserver.org. Dorier said operators who were hit should consider the whole server compromised, not just the wallet's seed. So treat the old recovery phrase as exposed too, and don't reuse it.
  • Keep only a working balance hot. BTCPay's own setup guide says a hot wallet "exposes funds if either the account or server is compromised", and describes connecting an existing wallet, which keeps the private keys off the server, as the normal choice. If you need a hot wallet for refunds or payouts, move the extra to cold storage regularly, as BTCPay advised in August.
  • If you only paid a shop through BTCPay: BTCPay's warnings are aimed at the people and businesses who run the software, and the reported thefts came from hot wallets on those servers. None of BTCPay's statements so far mention customers' wallets. Ignore any message saying you must "verify" or "recover" a past payment; that's a common follow-up scam.
  • For everyone: the same rule applies to your own coins. Money in an app or wallet that's always online is only as safe as that device. That's why long-term savings are usually kept in a wallet that stays offline. Our guide to crypto wallets explains hot and cold wallets.

The takeaway

This wasn't a flaw in bitcoin itself. It hit businesses running older copies of one payment program, and it hit the coins they kept on an internet-connected server. BTCPay says it has no credible reports of drains on the latest release, 2.4.7. The lessons are old ones: update the software that touches your money, and keep only what you need in a hot wallet.

Frequently asked questions

What is BTCPay Server?

It's free, open-source software that shops and other businesses install on their own server to accept bitcoin payments. There's no company in the middle holding the money: payments go to the business's own wallet. That also means every business is responsible for keeping its own copy of the software updated.

What is a hot wallet?

A wallet whose private key, the secret that approves payments, sits on a computer that's connected to the internet. BTCPay's hot wallet option stores that key on the merchant's server so it can send coins from the BTCPay screen. It's convenient, but anyone who takes over the server or the account can send the coins too. A cold wallet keeps the key offline.

I paid a store through BTCPay. Am I affected?

BTCPay's statements so far don't mention customers' wallets. BTCPay's warnings are aimed at the people and businesses who run the software, and the reported thefts came out of those servers' own hot wallets. As always, be wary of anyone who contacts you claiming you need to "verify" or "recover" a payment.

Is this the same problem as the BTCPay attack in August?

Not confirmed. In August, version 2.4.2 fixed a flaw that let attackers grab login files for Lightning nodes run through BTCPay, and funds were stolen. BTCPay said then that its hot wallets weren't affected. This time the reports involve hot wallets, and Dorier said traces of vulnerabilities from before 2.4.2 were found. Dorier says a blog post with details is coming.

Sources

  1. BTCPay Server warning on swept hot wallets (X, November 1, 2026) — BTCPay Server
  2. BTCPay Server incident response update (X, November 2, 2026) — BTCPay Server
  3. BTCPay Server note on hosting providers (X, November 2, 2026) — BTCPay Server
  4. Nicolas Dorier update on affected versions (X, November 2, 2026) — Nicolas Dorier
  5. Nicolas Dorier on traces of pre-2.4.2 vulnerabilities (X, November 2, 2026) — Nicolas Dorier
  6. Nicolas Dorier reply on compromised servers (X, November 2, 2026) — Nicolas Dorier
  7. Nicolas Dorier on updating and hot wallet balances (X, November 2, 2026) — Nicolas Dorier
  8. BTCPay, a bitcoin payment tool, tells users to switch off their servers after reports of drained wallets (November 1, 2026) — CoinDesk
  9. BTCPay Server warns of hot wallet thefts running on outdated software (November 2, 2026) — Cointelegraph
  10. Security Advisory: Update BTCPay Server to 2.4.2 Immediately — BTCPay Server
  11. BTCPay Server wallet setup: Protect the Wallet — BTCPay Server
  12. BTCPay Server releases — GitHub

Published November 2, 2026 by . Educational content, not financial, legal or tax advice. Spot an error? Request a correction.

About the author

Dave McNaught has worked in IT since 1999 and founded All Business Technologies (ABT) in 2003, a Boston-area firm providing Managed IT, Cybersecurity, Managed AI, Web Design and App Development. He publishes The Crypto Guide.

Full bio