BTC$78,085
ETH$2,284
BNB$707.45
XRP$1.25
SOL$94.18
TRX$0.3152
HYPE$85.55
ZEC$1,266
DOGE$0.0753
XMR$607.02BTCPay Server tells operators to shut down as hot wallets are drained
On Nov. 1 BTCPay Server reported hot wallets on its servers being swept by attackers. Releases older than 2.4.2 are involved; the total loss has not been disclosed.
The BTCPay Server team said on X at about 22:25 UTC on Nov. 1 (5:25 PM ET) that it was receiving reports of hot wallets on BTCPay servers being swept by unauthorized attackers, and asked operators to shut instances down with ./btcpay-down.sh until the investigation ends. The total loss and the number of victims have not been disclosed.
Details
Project founder Nicolas Dorier clarified about two hours later that the cases appear to involve releases older than 2.4.2. According to CoinDesk, the attackers had administrator-level access, but how they got it is unknown and the safety of newer versions has not been confirmed. ForkLog puts the affected range at 2.4.1 and earlier.
For servers on version 2.4.7, there are no credible reports of stolen funds so far, Bitcoin.com News reports. Version 2.4.7 was released on Oct. 29; ForkLog says it fixed 85 security issues, one of them critical. A separate flaw in BTCPay's Lightning integration was exploited in August 2026.
What it means for the market
BTCPay Server is a self-hosted, open-source payment processor: merchants keep keys on their own servers rather than with an intermediary. The incident hits operators who have not updated and is not a problem with the Bitcoin network itself. Operators should follow the project's updates and upgrade once the investigation concludes. For the live bitcoin price, see the daily brief and the Bitcoin page.
Not investment advice.
Comments