BTCPay Server issued an emergency security alert on November 2, 2026, urging operators of the self-hosted payment platform to shut down their servers immediately following reports of compromised Bitcoin hot wallets. Attackers reportedly breached vulnerable installations and drained the funds stored within them.
Mitigation instructions were issued without delay. Operators have been directed to execute the ./btcpay-down.sh script to halt their systems while an investigation into the vulnerability remains underway. The core message was an urgent call to action: disconnect servers immediately before balances are swept out.
Which Versions Are Affected
Initial findings from the development team indicate that the attack vector targets outdated installations. The vulnerability was identified on servers still running version 2.4.1 - a release dating back to July 23, 2026 - as well as earlier versions. During the attacks, the perpetrator reportedly obtained administrator credentials on affected instances before sweeping funds from connected Bitcoin hot wallets.
The situation differs for the latest release. The development team confirmed that version 2.4.7 is secure, stating they have received no credible reports of drained funds on updated instances. BTCPay Server co-founder Nicolas Dorier confirmed that the project’s public server running version 2.4.7 experienced no intrusions. Dorier noted that the attacks appear to intentionally target installations running releases prior to 2.4.2.
The full extent of the losses has not yet been publicly disclosed. The project has not released details regarding the total value of lost funds, the number of compromised servers, or the specific technical exploit utilized by the attacker. While mapping out the intrusion path, the security team has asked affected victims to submit their system logs immediately.
Second Vulnerability in Three Months
The early November incident comes less than three months after another security vulnerability impacted the platform. In August 2026, BTCPay Server addressed an exploit targeting LND admin macaroon credentials on the Lightning Network.
The recurrence of attacks targeting administrator credentials and hot wallets serves as a stark warning for merchants who choose to run their own payment infrastructure. Self-hosting provides complete sovereignty over assets, but it also demands uncompromising discipline in applying software updates. For operators still running older releases, executing the shutdown script today is the essential first step before checking whether their wallets remain intact.
Reported by crypto.news.
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
