BTCPay Server has warned users to shut down their payment servers after receiving reports of attackers gaining unauthorized access to older installations and draining funds from connected Bitcoin hot wallets.
Summary
- BTCPay Server has urged operators to shut down their payment servers after receiving reports of attackers gaining unauthorized access and draining funds from connected Bitcoin hot wallets.
- The project’s investigation identified an attack vector affecting installations running version 2.4.1 or older, while the latest 2.4.7 release has no credible reports of wallet drains.
- BTCPay Server co-founder Nicolas Dorier said attackers had managed to log in with administrator privileges on affected instances, although investigators have yet to determine how they obtained access.
- Hosting providers, including LunaNode, have taken precautionary action to shut down some installations, while affected users have been asked to submit incident details and server logs.
- BTCPay Server has not disclosed the total amount of cryptocurrency stolen or the number of compromised servers, and its investigation remains ongoing.
In a November 2 security alert, the open-source Bitcoin payment processor said it was investigating reports of unauthorized wallet withdrawals and asked operators to temporarily shut down their instances using the ./btcpay-down.sh script.
The warning initially applied to all users while the team worked to determine how attackers were gaining access. A subsequent investigation narrowed the suspected attack vector to installations running version 2.4.1, released on July 23, 2026, or earlier.
BTCPay Server said it had received no credible reports of hot wallet drains involving the latest version, 2.4.7, and urged operators to keep their software updated.
The project has not disclosed how much cryptocurrency was stolen, how many servers were compromised, or how many users have reported losses.
BTCPay Server identifies older installations as attack targets
According to the project’s latest advisory, its incident response investigation identified an attack vector affecting older versions of the payment software, although the team has not yet publicly explained the technical weakness that allowed the intrusions.
BTCPay Server is a self-hosted cryptocurrency payment processor that allows merchants and individuals to accept Bitcoin payments without relying on a traditional payment intermediary. Operators can manage their own payment infrastructure and connect wallets to receive and manage funds.
The reported attacks involved hot wallets, which remain connected to online systems and can be used to send cryptocurrency transactions. Funds held in these wallets can be exposed if attackers gain sufficient access to the systems controlling them.
In its initial warning, BTCPay Server said it was receiving reports of hot wallets being swept by unauthorized attackers. A wallet sweep involves transferring available funds from one or more addresses to another destination.
The project’s instructions called for operators to shut down their instances while the investigation continued. Its later update provided more specific information about the affected software versions and the absence of credible drain reports involving release 2.4.7.
Users who believe their servers were compromised have been asked to send incident details and relevant system logs to [email protected].
BTCPay Server founder says attackers obtained administrator access
BTCPay Server co-founder Nicolas Dorier provided further details about the suspected intrusions in a separate November 2 statement.
Dorier said the project’s public servers, which were running version 2.4.7, had not been attacked. Based on the reports available to him, affected installations appeared to be running versions released before 2.4.2.
He explained that the attacker had managed to log in with administrator privileges on the affected instances, but the team was still trying to determine how that access had been obtained.
Administrator access can give someone control over important server settings and functions, depending on the software configuration and permissions available to the account.
The latest incident follows an earlier security breach in August, when BTCPay Server warned of an actively exploited vulnerability that could result in stolen funds.
As crypto.news previously reported, the project urged users to upgrade to version 2.4.2 immediately or shut down their servers if they could not install the security patch.
The August vulnerability allowed attackers to obtain LND administrator macaroon credentials from affected installations and access connected Lightning wallets. BTCPay Server said the flaw did not compromise ordinary on-chain wallets, including hot wallets.
The project subsequently announced a recovery bounty equal to 10% of recovered funds, capped at 3 BTC if all stolen assets were retrieved.
The BTCPay Server Foundation committed 0.21 BTC each to Sparrow Wallet developer Craig Raw and the Bitcoin Red Team fund for discovering and reporting the earlier vulnerability.
Hosting providers shut down some BTCPay Server instances
Following the latest warning, hosting providers began taking precautionary action to prevent older installations from remaining exposed.
In another November 2 update, BTCPay Server said users running the software through a hosting provider might find that their instances had already been shut down automatically.
The project thanked LunaNode and other hosting companies for responding quickly after its initial announcement.
Such shutdowns mean some operators may be unable to access their payment servers until their hosting provider restores service or the affected installation is brought back online.
BTCPay Server has not published a complete list of hosting providers that suspended instances or disclosed how many servers were taken offline.
The security warning comes after another recent incident involving Bitcoin payment infrastructure. In September, Core Lightning warned operators that attackers were targeting older, unpatched Lightning nodes.
Core Lightning said it had received reports of attacks against vulnerable installations, although it had not established whether those attempts had resulted in stolen funds.
Security investigation continues as users report wallet losses
BTCPay Server’s self-hosted design gives operators direct control over their payment systems, including software updates, server administration and wallet configurations.
The project has recommended limiting the amount of cryptocurrency kept in hot wallets and moving excess funds into cold storage, where private keys are maintained offline.
Its latest release, version 2.4.7, was identified as the version for which the team had received no credible reports of wallet drains. The statement did not establish that every earlier release was compromised or that every installation running an affected version had suffered a loss.
BTCPay Server has asked affected operators to preserve and submit logs to its security team as investigators continue examining the administrator access reported by Dorier.
No public timeline has been provided for the completion of the investigation, and the project has not announced any recovery of cryptocurrency taken from affected wallets.
