Is Your BTCPay Server Safe? What the Hot Wallet Drain Investigation Shows
Attackers gained admin access to outdated BTCPay Server instances and swept their hot wallets, with traces pointing to flaws that predate an August patch.
The BTCPay Server team first raised the alarm late on November 1, asking every operator to shut down their instance until the investigation concludes. The attack specifically targets version 2.4.1, released on July 23, 2026, and anything older. The team has no credible reports of drains on the current 2.4.7 release.
Attack Vector Identified
Founder Nicolas Dorier revealed that the attacker logged in as an admin on affected servers, though the exact method remains under investigation. The breach marks at least the second time in three months that attackers have stolen funds from BTCPay Server instances running versions older than 2.4.2.
We have no credible reports of hot wallet drains for users running the latest 2.4.7 release. We again urge everyone to keep their BTCPay Server...
Risk Assessment
Don't put more than you are ready to lose in hot wallet. We can't guarantee it won't happen again.
The incident highlights vulnerabilities in self-hosted Bitcoin infrastructure. Hosting providers like LunaNode reportedly shut down customer instances automatically to block attacks on older versions. Dorier, who runs version 2.4.7 with a hot wallet himself, warned against keeping large sums on any server.
Related
