BTCPay Server Hack: Bitcoin Hot Wallets Drained, Shut Your Server Down Now - CryptoTicker.io
BTCPay Server, the most widely used self-hosted Bitcoin payment processor, has confirmed attackers are sweeping hot wallets on older installations and has asked all operators to take their instances offline.
Late on Saturday, 1 November, the BTCPay Server team posted an emergency alert after receiving reports of hot wallets being emptied by unauthorized attackers. The instruction was direct: operators must shut down their servers using the ./btcpay-down.sh script and await further instructions.
By Sunday, the incident response team had identified that only installations running version 2.4.1, released on 23 July 2026, or older were affected. There are no credible reports of drained wallets on the current 2.4.7 release.
Attack Details
Co-founder Nicolas Dorier revealed a concerning detail: the attacker successfully logged into affected instances with administrator privileges. The method of obtaining this access remains unknown. Importantly, BTCPay's own public servers, which run version 2.4.7, were not compromised.
The attacker managed to log in to the affected instances with administrator privileges.
Unknown Impact
The exact amount of Bitcoin stolen remains undisclosed, as BTCPay Server has not published any figures. The team also hasn't revealed how many servers were compromised or how many operators have reported losses.
Affected users are being asked to provide incident details and server logs to help the security team determine the scale of the breach. Hosting providers like LunaNode have already begun automatically shutting down older instances.
Response Steps
Operators must immediately shut down their BTCPay instances, even those on recent versions, until the investigation concludes. They should check hot wallet balances and move remaining funds to cold storage, as BTCPay has long recommended keeping only operating float in hot wallets.
Before restarting, operators must update to version 2.4.7 or a newer patched release, rotate all admin credentials, and preserve logs for the security team. Any unexplained transactions should be reported without wiping the server.
Related
