Outdated BTCPay Server Instances Hit in Hot Wallet Attack

Unauthorised access to insufficiently updated BTCPay Server setups allowed the draining of hot wallets, with evidence indicating the vulnerabilities existed before an August update.

Operators who failed to apply patches bore the brunt, though the specific amount lost remains unconfirmed by the team. As an open-source, self-hosted Bitcoin payment processor, BTCPay Server relies on hot wallets that retain the private keys, removing the need for manual signing per transaction. Consequently, any administrative user on the server can initiate coin transfers.

What BTCPay Server Versions Were Hit?

The BTCPay Server team issued a warning late on 1 November, advising all operators to take their instances offline pending the conclusion of the probe.

A subsequent message from the team refined the target. The vulnerability specifically impacts version 2.4.1, which came out on July 23, 2026, along with all predecessor versions. Currently, the team states there are no verified instances of funds being taken from systems running the latest 2.4.7 update.

📢 Our incident response investigation identified an attack vector targeting instances running versions 2.4.1 (Jul 23, 2026) or older.

We have no credible reports of hot wallet drains for users running the latest 2.4.7 release. We again urge everyone to keep their BTCPay Server…

— BTCPay Server (@BtcpayServer) November 2, 2026

BTCPay Server founder Nicolas Dorier noted that the intruder gained administrative access to the compromised servers, with the method of entry still undetermined. Investigators have, to date, uncovered evidence of security gaps existing prior to the 2.4.2 release.

This incident is at least the second instance in a three-month period where older BTCPay Server versions (pre-2.4.2) had their funds stolen. The 2.4.2 update fixed a serious vulnerability in August that allowed intruders to take Lightning node credentials remotely and empty the linked wallets.

At the time of the patch, the vulnerability was already being actively exploited.

How Risky Are BTCPay Server Hot Wallets?

Hosting providers followed suit. The team reports that LunaNode and similar hosts may have automatically turned off customer instances running older versions to thwart the attacks.

Dorier himself operates the 2.4.7 release paired with a hot wallet. Nonetheless, the founder advised against holding substantial funds on any server.

Don’t put more than you are ready to lose in hot wallet. We can’t guarantee it won’t happen again.

Nicolas Dorier, X

This breach aligns with a wider trend observed in self-hosted Bitcoin systems. Core Lightning, for instance, recently cautioned that unpatched nodes are being actively sought out by attackers. In both scenarios, the required security update was available prior to the thefts, highlighting the vulnerability of operators who set up a server and fail to apply subsequent patches.