BTCPay Server Warns After Hot Wallet Theft
Attackers mainly targeted BTCPay Server instances running old versions; after the hot wallet drain, the open-source Bitcoin payment processor asked operators to shut down their servers.
Key Takeaways
- Attackers gained access to outdated BTCPay Server instances and drained hot wallets there.
- BTCPay Server asked operators on November 1 to shut down their instance while the investigation continues.
- Version 2.4.1 and older were affected; there are no credible reports of drains for version 2.4.7.
Attackers gained access to outdated BTCPay Server instances and drained hot wallets there. According to the team, the traces point to flaws that already existed before an August patch, while there are no credible reports of drains for the latest release, 2.4.7.
Old Versions Hit
BTCPay Server asked on November 1 all operators to shut down their instance until the investigation is finished. It later became clearer that the attack vector affects version 2.4.1, which was released on July 23, 2026, and everything older than that. The damage mainly hits users who never updated, while the total loss is still unknown.
Founder Nicolas Dorier said that the attacker logged in as an admin on the affected servers, but it is not yet clear exactly how that happened. The investigation did find traces of vulnerabilities older than version 2.4.2. That matters because that release had already patched a critical bug in August that let attackers remotely steal Lightning node data and drain linked wallets.
Why Hot Wallets Are Vulnerable
BTCPay Server is an open-source Bitcoin payment processor that merchants self-host. In a hot wallet setup, the server stores the private keys itself, so the system can send payments without the operator signing each transaction separately. If someone gets admin access to such a server, they can also move the coins.
The team says hosting providers like LunaNode may have stepped in quickly by automatically disabling customer setups on old versions. Dorier himself uses version 2.4.7 with a hot wallet, but he also warned that large amounts do not belong on a server. He wrote that you should not keep more on it than you are willing to lose.
Broader Risk for Bitcoin Infrastructure
The case fits into a broader pattern around self-hosted Bitcoin infrastructure. Core Lightning recently warned that attackers are also targeting unpatched nodes. For European crypto users and companies, this shows that self-custody can offer more control and privacy, but it also requires tight update management and a fast response to security alerts.
Vulnerable Lightning nodes have also come under fire recently, showing how quickly unpatched Bitcoin infrastructure becomes a target. The BTCPay Server case mainly underscores that a one-time setup is not enough. If the software is not updated, an old vulnerability can still end up causing a Bitcoin loss months later.
