Key Points
- BTCPay Server issued an emergency shutdown directive on November 2 after multiple reports surfaced of Bitcoin hot wallet compromises.
- Installations running version 2.4.1 from July 23, 2026, or earlier versions are believed to be vulnerable to the attack.
- Version 2.4.7 users have not reported any credible incidents of wallet drainage according to the development team.
- Project co-founder Nicolas Dorier confirmed that intruders obtained administrator-level credentials, though the entry method remains undetermined.
- Neither the total amount stolen nor the number of compromised servers has been publicly disclosed by BTCPay Server.
An urgent security advisory issued by BTCPay Server on November 2 instructed operators to immediately halt their payment processing systems following multiple reports of Bitcoin hot wallet breaches. The directive came as the team began investigating unauthorized cryptocurrency withdrawals from connected wallets.
The self-hosted, open-source Bitcoin payment platform recommended that all instance operators execute the ./btcpay-down.sh shutdown script as an immediate protective measure while the investigation continued.
Initially, the security warning encompassed all BTCPay Server deployments. However, subsequent analysis by the development team identified the vulnerability as specifically affecting installations running version 2.4.1—which was released on July 23, 2026—and any earlier releases.
Vulnerability Isolated to Legacy Software Releases
According to BTCPay Server’s security team, no verified incidents have been reported involving the current stable release, version 2.4.7. The project strongly advised all operators to ensure their software is running the most recent version available.
Details regarding the specific technical vulnerability exploited in these intrusions have not been released. Similarly, the organization has withheld information about the total financial losses and the exact number of affected installations.
BTCPay Server provides a decentralized payment processing solution that enables businesses and individuals to receive Bitcoin payments directly, eliminating intermediary payment processors and third-party dependencies.
The security incidents specifically targeted hot wallets—cryptocurrency storage systems that maintain constant internet connectivity. By design, these wallets remain vulnerable if unauthorized parties successfully penetrate the underlying infrastructure managing them.
Unauthorized Administrator Credentials Obtained
In a detailed statement released on November 2, co-founder Nicolas Dorier provided additional context regarding the security breach. He confirmed that the project’s publicly hosted servers, all operating on version 2.4.7, remained unaffected by the attacks.
Dorier explained that the perpetrators successfully authenticated using administrator-level permissions on compromised systems. The investigation team continues working to identify the exact method by which these privileged credentials were obtained.
According to Dorier’s analysis of incoming reports, the vulnerable installations appear to be running software versions released before the 2.4.2 update.
This security incident follows just under three months after BTCPay Server addressed a separate vulnerability in August. That earlier breach involved a flaw that allowed attackers to extract Lightning Network Daemon (LND) administrator credentials, providing access to connected Lightning Network wallets.
The August vulnerability specifically affected Lightning Network integrations and did not compromise standard on-chain Bitcoin wallets. Whether the current attack vector has any connection to the previous security flaw remains under investigation.
Several hosting providers have taken proactive measures in response to the breach. LunaNode and other service providers have suspended certain installations as a precautionary step. BTCPay Server has indicated that users relying on managed hosting services may discover their instances have been automatically disabled.
A comprehensive list of all hosting providers that implemented automatic shutdowns has not been made available. Some operators may experience service interruptions until their hosting providers restore access to their payment processing systems.
As a security best practice, BTCPay Server advises users to maintain minimal balances in hot wallet environments. The project recommends transferring surplus funds to cold storage solutions, where cryptographic keys remain completely offline and isolated from network access.
Users who believe their installations may have been compromised are directed to submit incident reports and relevant server logs to security@btcpayserver.org. The development team has not provided an estimated completion date for the ongoing investigation, and no information about fund recovery efforts has been released.
Get 3 Free Stock Ebooks
Discover top-performing stocks in AI, Crypto, and Technology with expert analysis.
- Top 10 AI Stocks - Leading AI companies
- Top 10 Crypto Stocks - Blockchain leaders
- Top 10 Tech Stocks - Tech giants
