On 2 November 2026 BTCPay Server said its investigation had identified an attack vector against instances running version 2.4.1, released on 23 July 2026, or older. It said it had no credible reports of hot-wallet drains on the latest release, 2.4.7. The post followed a warning late on 1 November, from the project’s X account, that some operators had reported wallets being drained, and that servers should be taken offline while that was checked. BTCPay has not published a count of servers, a total taken, or a description of how the access was obtained. This page will not invent one.
Founder Nicolas Dorier said the attacker logged in as an admin on the affected servers. The project has not said how that login was gained. It said the investigation has found traces of vulnerabilities that predate version 2.4.2. In August, BTCPay told operators that a flaw in versions before 2.4.2 had been used to take Lightning credentials and move funds, and that it would not publish the mechanics while people were still updating. This week’s posts do not say the new drains are that August flaw. They also do not clear every version between 2.4.2 and 2.4.6. The sentence they actually published is narrower: the vector they have identified targets 2.4.1 and older, and they have no credible drain reports on 2.4.7. This page will not describe how an admin session is obtained.
What happened
BTCPay Server is software a merchant or a person runs themselves, so they can take bitcoin payments without handing the coins to a payment company. In a hot-wallet setup the server holds the keys and can send. That is the product. It is also why an admin login is enough to spend what sits there. The coins are not in a vault that waits for a second person. They are on the machine. See How crypto wallets actually work if a login and a key still feel like the same object.
The 1 November warning was a stop. The project told operators to shut instances down until the look was finished. The 2 November post is the narrower finding, and it tells people to update. BTCPay also said some hosts, including LunaNode, may have taken customer instances on older versions offline. A host pulling the plug is that host’s switch. It is not a refund, and it is not a statement that every old server on the internet was reached.
Dorier said he runs 2.4.7 with a hot wallet himself, and then said not to put more on a hot wallet than you are ready to lose. “We can’t guarantee it won’t happen again.” Current software is not a promise that the next report will spare it. A hot wallet is a float you can spend from a server. The amount you leave there is the amount an admin session can move.
Why it matters
If you run BTCPay, you are the operator. The balance on that server is not an exchange credit and not a claim on BTCPay the project. The project does not custody the coins. Your server does, for as long as the keys live on it. A customer who already paid you has paid you. If that payment landed in the hot wallet and the hot wallet was swept, the loss is the operator’s. A buyer who holds their own keys, and who only sent a payment, was not the wallet that was drained.
Version 2.4.7 having no credible drain reports is a status from the project on the morning of 2 November. It is not a certificate for a server you installed once and never opened again. If yours is on 2.4.1 or older, the project’s sequence was to take it offline and update. A server you cannot update is a server that should stay off. Update from BTCPay’s own admin screen or the path in its own documentation. A message, a file, or a “support” account that offers to do it for you, and asks for a recovery phrase, is not that path. See A practical checklist for keeping crypto safer.
What happens next
A loss figure, if the project publishes one. A technical account, which it has not given, and which this page will not supply from elsewhere. More reports from operators on old versions. The practical test is the version string on the server you run, and whether that server is still on the network. Watch BTCPay’s own account and its blog. We will not treat “no credible reports on 2.4.7” as “a hot wallet cannot be drained”, and we will not treat a shutdown by a host as the coins coming back.
Not a recommendation to install, keep, or abandon BTCPay. Not a finding that every self-hosted payment server was hit. Not a description of the access. The project’s own account, on the morning of 2 November, was that the investigation had named a version line and had not named a method.
