BTCPay Server Calls for Server Shutdowns After Hot Wallet Theft

Developers of the BTCPay Server payment service have warned about thefts from hot wallets on outdated installations. In a notification dated November 2, 2026, the team asked operators to temporarily shut down servers using the script ./btcpay-down.sh until the investigation is completed; initially, the warning applied to all users.

Later, the scope was narrowed: the vulnerability affects versions 2.4.1 and older, including 2.4.1, released on July 23, 2026. According to the project, there are no credible reports of thefts related to the latest version 2.4.7, and operators are urged to update.

Co-founder of BTCPay Server Nicolas Dorier clarified that the project's public servers on 2.4.7 have not been attacked, and affected installations, according to reports, were running on versions older than 2.4.2. The attacker accessed the system with administrator rights, but how they obtained them is still being investigated. The project has not disclosed the amount stolen, the number of affected servers, or the number of reported losses, citing an ongoing investigation; affected parties are asked to send data and system logs to security@btcpayserver.org.

Context

In August, BTCPay Server had already warned about an actively exploited vulnerability: at that time, attackers obtained LND administrator macaroon credentials and access to Lightning wallets, but according to the project, regular on-chain wallets, including hot ones, were not affected. For discovering that vulnerability, the project promised a reward of 10% of the returned funds with a cap of 3 BTC and awarded 0.21 BTC each to Sparrow Wallet developer Craig Raw and the Bitcoin Red Team fund.

Following the new warning, hosting providers began automatically disabling old installations; BTCPay Server thanked LunaNode and others for their quick response. The project recommends keeping a minimum amount of funds in hot wallets and transferring excess to cold storage. In September, Core Lightning issued a similar warning: attackers targeted old unpatched nodes. There are no deadlines for the completion of the investigation or reports of fund recovery yet.