In a November 2 update, the open-source payment platform said its investigation had identified an attack vector affecting instances running version 2.4.1, released on July 23, 2026, or earlier. The project reported no credible evidence of wallet drains involving its latest release, version 2.4.7.
The disclosure followed an emergency warning on November 1 instructing operators to shut down their servers while developers investigated reports of unauthorized withdrawals.
BTCPay has not disclosed the number of affected installations or the total value of stolen funds, leaving the financial impact unresolved.
How Did Attackers Access BTCPay Server Hot Wallets?
BTCPay Server founder Nicolas Dorier said the attackers had managed to log in with administrator privileges on affected installations. However, the development team has not established precisely how that access was obtained.
According to Dorier, the available evidence points to vulnerabilities affecting software versions older than 2.4.2. The project’s own public servers, running version 2.4.7, were not compromised, he said.
The distinction matters because BTCPay Server allows merchants to process Bitcoin payments without relying on a centralized payment custodian. Operators can connect external wallets or configure hot wallets that store private keys directly on their servers.
Hot wallets make automated transactions and payouts possible, but storing signing credentials on internet-connected infrastructure creates additional exposure. An attacker who obtains sufficient access to the server may be able to authorize transfers without the merchant’s approval.
Watch-only configurations operate differently because private keys remain outside the server, requiring transactions to be signed separately. Such arrangements reduce the risk of direct wallet theft through server compromise, although unauthorized administrative access can still threaten payment settings and operational integrity.
Investor Takeaway
The immediate exposure concerns outdated payment infrastructure and server-held wallet credentials, not a vulnerability in Bitcoin’s underlying network.
Why Does the Incident Resemble the August Attack?
The latest withdrawals follow an August BTCPay Server security incident in which attackers exploited a vulnerability that exposed administrative credentials for Lightning Network Daemon (LND) nodes.
That earlier flaw allowed unauthenticated attackers to retrieve credential files known as macaroons, potentially granting control over affected Lightning nodes and enabling unauthorized transfers.
BTCPay addressed the vulnerability through version 2.4.2, released on August 7, which updated LND and regenerated administrative credentials on standard installations. The project also temporarily restricted public remote access to LND to reduce further exposure.
Importantly, developers confirmed that the August vulnerability did not affect BTCPay’s ordinary on-chain hot wallets. The latest incident involves a different category of funds, with attackers reportedly obtaining administrator access before draining wallets.
Although both incidents involve installations running versions earlier than 2.4.2, BTCPay has not confirmed that the same vulnerability was responsible or that the attacks were connected.
Security concerns have also affected other Bitcoin payment infrastructure. In October, Core Lightning warned operators to upgrade after receiving reports of attackers targeting unpatched nodes. That warning did not establish confirmed fund theft.
What Should Operators Do to Protect Their Funds?
BTCPay initially instructed operators to shut down affected servers using its standard shutdown procedure while the investigation continued. Its subsequent announcement urged users to keep their installations updated to version 2.4.7.
The latest release, published on October 29, addressed 85 security findings identified through Anthropic’s open-source security scanning program, including one critical and 13 high-severity findings.
However, BTCPay has not publicly identified which specific weakness enabled the latest wallet withdrawals. The release notes therefore should not be interpreted as proof that any particular patch prevented the reported attack.
Operators running older software face additional considerations beyond installing an update. If an attacker obtained administrator access, credentials and wallet seeds stored on the compromised server may need to be treated as exposed.
Merchants should review transaction histories, investigate unfamiliar administrative activity and move remaining hot-wallet balances to newly secured wallets where compromise is suspected.
The project has asked affected users to submit incident details and server logs to its security team to support the investigation.
Investor Takeaway
Updating software limits future exposure, but potentially compromised wallet credentials require separate remediation to prevent further unauthorized withdrawals.
What Does the Attack Mean for Self-Hosted Bitcoin Payments?
Unlike centralized payment platforms, BTCPay Server operates through independently managed installations. The project cannot universally suspend every merchant’s server or directly enforce security updates across its user base.
That structure gives merchants control over their payment infrastructure but makes their security dependent on patch management, wallet configuration and server administration.
The trade-off is particularly important for businesses holding operational liquidity in hot wallets. Maintaining accessible balances supports automatic payments and refunds, but also increases the potential financial damage from a compromised server.
The latest incident comes as major cryptocurrency platforms face renewed scrutiny over hot-wallet security, although the underlying custody arrangements and attack mechanisms differ.
For BTCPay, the next critical disclosures will concern the precise attack mechanism, the number of affected merchants and the financial losses. Until those details are established, operators must assess their exposure primarily through software versions, administrative access records and wallet transaction histories.