EN
Español
Português (Brasil)
Türkçe
Tiếng Việt
Bahasa Indonesia
Polski
Čeština
Română
Slovenčina
Magyar2 Nov 2026
BTCPay Server, the open-source bitcoin payment processor used by merchants, asked operators on Sunday to switch off their servers after reports that attackers swept hot wallets. Founder Nicolas Dorier said the reports appear to involve versions older than 2.4.2. No loss figure or fix has been announced.
Bitcoin TradeReviewed News Desk
BTCPay Server, the free, open-source tool many businesses use to accept bitcoin payments, urged every operator on Sunday, Nov. 1, to switch off their servers while it investigates reports that attackers drained merchants’ hot wallets, CoinDesk reported. The project has not given a loss figure, a count of affected servers or a fix.
What BTCPay said
“We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers. If you’re running an instance, please shut it down (./btcpay-down.sh) until we complete the investigation,” the project posted on X. The command stops the software, and BTCPay asked owners to keep it off until the investigation ends. The shutdown call was not limited to one version.
About two hours later, founder Nicolas Dorier said the theft reports “appear to involve BTCPay Server releases older than version 2.4.2.” He said an attacker logged in as an administrator on the affected servers, but the team does not yet know how that access was obtained. Dorier said the project’s own public servers, which run version 2.4.7, “were not attacked”. He did not say whether newer versions are safe, so that point remains unconfirmed.
Why hot wallets are exposed
BTCPay is self-hosted: each merchant runs the software on its own server and receives bitcoin directly, with no custodian in the middle. In hot wallet mode, the seed phrase needed to send coins is stored on that internet-connected server, and BTCPay can use it to sign payments automatically. BTCPay’s own documentation marks the feature with a “DANGER” label. Anyone who takes over the server can send the coins elsewhere. Because every instance is independent, there is no central switch, which is why the project had to ask each operator to shut down.
It is not the first scare this year. In August, BTCPay confirmed that attackers stole funds through a flaw in versions before 2.4.2 that exposed credential files for LND, the Lightning node software. That bug was fixed in 2.4.2. Whether Sunday’s reports are linked to the August flaw has not been confirmed.
The alert lands days after the record $6.3 billion Binance hack, attributed by the FBI to North Korea’s TraderTraitor group (our coverage).
What it means for traders and merchants
- Merchants: follow BTCPay’s instruction and keep instances offline until the project publishes its findings. Avoid storing large balances in hot wallets on internet-facing servers.
- Customers paying merchants: checkout pages for affected stores may be unavailable for a while.
- Self-custody basics: keep long-term holdings in cold storage and only small working balances online. If you buy bitcoin on an exchange, compare security features first in our exchange comparison, where BingX and OKX are our top picks, or see our cheapest way to buy bitcoin guide.
This is not financial advice.
Follow TradeReviewed on X and our Telegram channel: you hear crypto and trading news here first.
Related reviews
Sources
News is for information only and is not financial advice. More crypto news
You'll hear it here first
Get crypto news first on our Telegram channel.