Key Highlights
- BTCPay Server confirmed that attackers drained funds from hot wallets on affected self-hosted instances, prompting the project to issue an urgent alert on November 1, instructing operators to shut down their servers immediately using the command ./btcpay-down.sh until the investigation concludes.
- Early investigation revealed that thefts were limited to installations running version 2.4.1, released July 23, 2026, or older, with attackers logging in using administrator privileges, while public servers running the latest 2.4.7 release were not attacked, according to founder Nicolas Dorier.
- The incident comes amid a broader wave of crypto platform breaches, including Binance’s approximately $6.3 billion theft attributed to North Korea’s TraderTraitor and CoinDCX’s roughly $16 million loss, highlighting persistent risks around hot wallets, outdated software, and self-hosted security responsibilities.
On November 1, BTCPay Server, the open-source Bitcoin payment processor that merchants use to accept payments on self-hosted infrastructure, confirmed reports of unauthorized attackers draining funds from hot wallets on affected instances.
The project posted an urgent alert on X instructing operators to shut down their servers immediately using the command ./btcpay-down-.sh until the investigation is complete.
BTCPay Server lets businesses process Bitcoin payments without relying on third-party intermediaries. In hot-wallet setups, the private keys or seeds remain on the server to enable automatic transaction signing. This convenience creates risk because anyone who gains administrative access can move the funds. The project’s public servers, running the latest version 2.4.7, were not attacked, according to founder Nicolas Dorier.
BTCPay Shares Initial Investigation Details
Early updates from Dorier indicated the reported thefts appear limited to installations running releases older than version 2.4.2. Attackers logged in with administrator privileges on the compromised servers. The team has not yet determined exactly how that access was obtained.
A subsequent incident response update stated that the investigation identified an attack vector targeting instances running version 2.4.1, released July 23, 2026, or older. There are currently no credible reports of hot-wallet drains among users on the latest 2.4.7 release. The project again urged all operators to keep their software updated and asked affected users to send details and logs to security@btcpayserver.org.
No total loss amount, number of affected instances, or full technical details of the entry method have been published. Hosting providers such as LunaNode reportedly shut down older instances automatically after the initial warning. The incident follows an August 2026 vulnerability in versions prior to 2.4.2 that allowed attackers to obtain LND Lightning Network credentials and drain nodes. It remains unclear whether the current reports are connected.
Wide Pattern of Attacks on Crypto Platforms
The BTCPay reports arrive amid a wave of high-profile breaches targeting major cryptocurrency platforms. In late October 2026, Binance, the world’s largest exchange by trading volume, suffered a record theft of approximately $6.3 billion in digital assets. The FBI attributed the attack to the North Korean state-sponsored group TraderTraitor.
Attackers reportedly gained control of the exchange’s hot-wallet signing systems and moved funds across multiple blockchains in roughly 20 minutes. Binance has covered the bulk of losses with company reserves, including its SAFU fund, and resumed phased withdrawals. Customers withdrew billions in the immediate aftermath.
Indian exchange CoinDCX recently confirmed a roughly $16 million loss involving retired deposit wallets left over from a 2025 incident that previously cost the platform about $44 million. An automated sweeping process failed, allowing deposits to accumulate in vulnerable addresses that were then drained. The exchange stated it absorbed the loss and that active customer funds in cold storage remained secure.
These incidents, along with earlier breaches such as the 2025 Bybit theft of about $1.5 billion, also linked to North Korean actors, highlight persistent risks around hot wallets, outdated software, and complex attack chains. Self-hosted solutions like BTCPay place full security responsibility on individual operators, who must maintain updates, limit privileges, and prefer cold storage or read-only configurations for larger balances where possible.
BTCPay Server is currently investigating the matter and has prioritized rapid communication. Operators are advised to remain offline if running vulnerable versions.
