BTCPay warns of hot-wallet thefts on older servers

BTCPay Server moved on Nov. 2 to tell operators to pull their instances offline. Reports had come in of attackers sweeping hot wallets clean, according to Cointelegraph. The warning targets anyone still on version 2.4.1 or earlier.

“We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers. If you’re running an instance, please shut it down (./btcpay-down.sh) until we complete the investigation,” the project wrote, as reported by CoinDesk.

BTCPay Server is a free, open-source payment processor — businesses run it themselves to accept bitcoin directly, no third-party custodian.

Attackers obtained administrator access on affected servers, CoinDesk reported. The total number of operators hit, how much bitcoin was taken, and how credentials were obtained haven’t been disclosed.

The version history does at least bound the problem. BTCPay Server shipped 2.4.1 on July 23, 2026. Reported thefts appear confined to releases older than 2.4.2, and the project said it had received no credible drain reports from users on 2.4.7, its current release. BTCPay Server’s own public servers, also running 2.4.7, weren’t touched.

The 2.4.1-to-2.4.2 boundary carries prior weight. Whether whoever’s behind the current thefts is using the same vector, or something else entirely, the investigation hasn’t said.

The advisory doesn’t declare newer versions categorically safe from whatever method is now being used. What the known facts establish is narrower: a hot wallet on an unpatched self-hosted instance is exposed to any server compromise, and among operators on the current release, reported drain incidents stand at zero.