BTCPay servers hit by wallet sweepers as old versions become the digital equivalent of leaving the vault open 🧯

BTCPay Server urged merchants to shut down their instances on November 1, 2026, after receiving reports that attackers were draining hot wallets connected to affected servers. “We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers,” the project tweeted at 5:25 p.m. ET. “If you're running an instance, please shut it down (./btcpay-down.sh) until we complete the investigation.”

About two hours later, founder Nicolas Dorier said the reports appeared to involve releases older than version 2.4.2 and that the attacker had logged in to affected servers with administrator access. The project later said its investigation had identified an attack vector targeting instances running version 2.4.1, released on July 23, or older. “We have no credible reports of hot wallet drains for users running the latest 2.4.7 release,” it said, advising users to keep their software updated and send details and logs to its security team.

Some hosting providers, including LunaNode, automatically shut down BTCPay instances to prevent older versions from being exploited, according to the project. BTCPay has not disclosed how many servers were affected or how much Bitcoin was taken. Because the software is self-hosted, each merchant operates it on its own server, and no central operator can remotely switch off every instance.

Merchants running a hot wallet keep the wallet’s seed on an internet-connected server so it can automatically sign transactions. BTCPay’s documentation labels the feature “DANGER” and warns that it “comes with security implications.” The attacks came days after the project released version 2.4.7 on Thursday as an emergency update addressing one critical and several medium-severity vulnerabilities that it said were brought to its attention through Anthropic’s frontier open-source software scanner. BTCPay has not said whether the attacks exploited any of those flaws.

BTCPay Server had warned users on Friday that attackers were exploiting a critical vulnerability that could lead to stolen funds. In a post on X, the Bitcoin payment processor urged administrators to install version 2.4.2 and confirm the update in the server footer. “If you are unable to update right away, turn off your BTCPay Server to prevent unauthorized access until you can update,” the company wrote. In August, BTCPay also warned that a critical vulnerability affecting all versions before 2.4.2 was being actively exploited and instructed users to update or shut down their servers.