BTCPay Server has issued an urgent security alert after reports that unauthorized attackers are draining funds from hot wallets connected to older installations of the open-source Bitcoin payment processor.
In an initial warning posted on November 1, 2026, the project urged all operators to shut down instances using the ./btcpay-down.sh script while an investigation began. A follow-up advisory on November 2 narrowed the suspected attack vector to installations running version 2.4.1, released July 23, 2026, or older. The team said it had received no credible reports of hot wallet drains involving the latest version 2.4.7.
Co-founder Nicolas Dorier said attackers had logged in with administrator privileges on affected instances, but investigators had not yet determined how that access was obtained. The project has not disclosed the total amount stolen, the number of compromised servers, or how many users have reported losses.
Hosting providers including LunaNode have taken precautionary action to shut down some installations. Affected users were asked to submit incident details and server logs to the BTCPay Server security team.
The incident echoes an earlier August security breach, when BTCPay Server warned of an actively exploited vulnerability that could result in stolen funds and urged users to upgrade to version 2.4.2 or shut down servers. At that time, the flaw exposed LND administrator macaroon credentials and affected connected Lightning wallets. A recovery bounty equal to 10% of recovered funds, capped at 3 BTC, was announced.
The latest investigation remains ongoing, and the project has recommended limiting hot wallet balances and moving excess funds into cold storage.
