A BTCPay Server hack has raised fresh security concerns after the Bitcoin payment platform received reports of attackers withdrawing funds from merchants’ hot wallets.
On November 1, the open-source project issued an emergency warning, asking operators to temporarily shut down their payment servers while its team investigated the incidents.
The situation is particularly concerning for businesses that use BTCPay Server to accept Bitcoin without relying on traditional payment intermediaries.
As the investigation develops, we’re learning more about which software versions may be vulnerable and why keeping cryptocurrency payment infrastructure updated is essential.
TL;DR
- BTCPay Server warned operators to shut down their installations after receiving reports of unauthorized Bitcoin hot wallet withdrawals.
- Investigators identified an attack vector affecting version 2.4.1 and earlier, while no credible wallet-drain reports have emerged for version 2.4.7.
- The total amount stolen, number of affected merchants, and exact method attackers used to gain access remain unconfirmed.
BTCPay Server Hack Triggers Emergency Warning
BTCPay Server is a free, self-hosted Bitcoin payment processor that allows merchants to receive cryptocurrency payments directly.
Unlike centralized payment platforms, businesses manage their own servers and wallet configurations.
That independence offers greater control, but it also places responsibility for software security on individual operators.
On November 1, the project warned that unauthorized attackers were sweeping Bitcoin from hot wallets connected to certain installations.
Operators were instructed to shut down their servers using the ./btcpay-down.sh command while the investigation continued.
Because BTCPay Server operates through independently managed installations, its developers cannot remotely disable every affected server.
We find this particularly important. Decentralized infrastructure gives businesses more control, but responding to an emergency requires individual operators to act quickly.
Investigators Identify Older Software Versions
Following the initial warning, BTCPay Server’s investigation identified an attack vector targeting version 2.4.1 and earlier.
The project subsequently reported that it had received no credible reports of hot wallet drains involving its latest 2.4.7 release.
However, that doesn’t mean investigators have established that every newer configuration is completely secure.
BTCPay Server founder Nicolas Dorier indicated that attackers had gained administrator access to affected installations.
How that access was obtained remains under investigation.
The project released version 2.4.7 on October 29, shortly before the latest incidents became public.
According to its official GitHub release notes, the update addresses 85 security findings, including one classified as critical and 13 rated high severity.
We should distinguish those fixes from the ongoing investigation. The project has not publicly established that every reported wallet theft resulted from one of those specific vulnerabilities.
Why Bitcoin Hot Wallets Face Greater Risks
The reported attacks highlight an important difference between hot wallets and cold storage.
Hot wallets remain connected to the internet, making them convenient for businesses that regularly process payments.
However, that connectivity can also create opportunities for attackers.
If someone obtains sufficient control over a server holding wallet credentials, they may be able to authorize unauthorized transactions.
Cold storage reduces that exposure by keeping signing keys offline.
For businesses handling frequent Bitcoin transactions, balancing convenience and security remains a significant challenge.
As we follow Bitcoin developments, incidents involving payment infrastructure remind us that protecting digital assets involves more than securing the blockchain itself.
The applications and systems surrounding Bitcoin also need continuous protection.
Earlier Security Problems Add To The Concern
This isn’t BTCPay Server’s first security incident in 2026.
In August, the project disclosed a vulnerability that allowed attackers to obtain administrative credentials associated with connected Lightning Network wallets.
The weakness affected older installations and was addressed through version 2.4.2.
The latest investigation has again focused attention on installations that missed important security updates.
However, we cannot yet conclude that the November incidents used exactly the same method.
That distinction matters because an earlier vulnerability and a newly reported attack may share affected software versions without sharing an identical cause.
The situation also reflects a broader challenge across the cryptocurrency industry, where outdated software can expose businesses to significant financial losses.
What Happens Next For BTCPay Server?
BTCPay Server has not confirmed the total value of stolen Bitcoin or the number of compromised installations.
Investigators are continuing to examine the incidents, including how attackers obtained administrator privileges.
The project has urged users to keep their software updated and requested information from affected operators.
For businesses operating Bitcoin payment infrastructure, reviewing official security notices and following the project’s recovery guidance should remain a priority.
We’ll be watching for a confirmed explanation of the attack, additional remediation instructions, and any updates regarding stolen funds.
The incident also raises questions about how smaller businesses manage self-hosted payment systems.
As cryptocurrency payments become more common, dependable security practices will be increasingly important across the blockchain ecosystem.
BTCPay Server’s investigation is still developing, but one lesson is already clear: controlling your own Bitcoin infrastructure also means taking responsibility for protecting it.
