- BTCPay Server issued an emergency shutdown warning on November 1, 2026, after reports that attackers were draining Bitcoin from hot wallets connected to self-hosted payment servers.
- Founder Nicolas Dorier said preliminary findings point to installations running versions older than 2.4.2, while public and demonstration servers on version 2.4.7 had not been attacked.
- The warning followed the October 29 release of version 2.4.7, which addressed 85 reported security findings, highlighting the risks of unpatched, independently operated infrastructure.
BTCPay Server has warned merchants and self-hosted payment operators to take their servers offline after reports that attackers were sweeping Bitcoin from connected hot wallets.
The emergency notice, published by the project’s official account at approximately 22:25 UTC on November 1, 2026, instructed operators to shut down their BTCPay Server instances while developers investigated the reported compromises.
The incident raises concerns for merchants who use self-hosted Bitcoin payment infrastructure to avoid conventional payment intermediaries. It also highlights a security challenge for open-source software: a vulnerability fix only protects installations that actually receive and apply the update.
At the time of the initial reports, developers had not confirmed how much Bitcoin was stolen, how many merchants were affected or how attackers first gained access.
Developers Tell Operators to Take BTCPay Servers Offline
The project’s emergency message reported that hot wallets connected to BTCPay Server installations were being swept by unauthorized attackers.
Operators were told to stop their instances using the ./btcpay-down.sh command until investigators could establish the scope and cause of the incident.
Core contributor Uncle Rockstar Developer reinforced the warning, describing it as an urgent situation and telling operators with hot wallets to shut down their servers.
BTCPay Server is open-source payment software that allows merchants to accept Bitcoin directly, without depending on a conventional payment processor. Businesses can host the software themselves and retain control over their payment infrastructure and wallet arrangements.
That model offers greater operational independence, but it also places responsibility for server maintenance, software updates and wallet security on the operator.
Nicolas Dorier Points to Older Software Versions
BTCPay Server founder Nicolas Dorier later shared preliminary findings that narrowed the investigation toward older installations.
According to Dorier, the affected deployments were running versions released before 2.4.2. Attackers reportedly gained administrator access, with forensic traces pointing toward vulnerabilities present in those earlier releases.
Dorier also indicated that public and demonstration servers running version 2.4.7 had not been attacked.
This distinction is important because it does not point to the latest release as the apparent source of the reported compromises. However, the observation should not be interpreted as proof that every installation running version 2.4.7 is immune to attack.
Investigators had not yet published a complete technical explanation, so the precise entry point and relationship between the reported thefts and previously disclosed flaws remained unresolved.
Earlier Lightning Network Vulnerability Adds Context
The investigation also brings attention to a separate BTCPay Server security issue disclosed in August.
That vulnerability allowed unauthenticated attackers to obtain Lightning Network Daemon (LND) macaroon credentials. These credentials act as authorization tokens that grant access to specific Lightning Network operations.
Developers corrected the issue in version 2.4.2. At the time, they said BTCPay Server’s own on-chain wallets were not exposed through that particular vulnerability.
It has not been established whether the November wallet theft reports involve the same weakness, another vulnerability affecting older releases or a combination of security issues.
The distinction matters. A previously patched flaw may help explain exposure in outdated deployments, but it cannot be treated as the confirmed cause without a published forensic report.
Version 2.4.7 Fixed 85 Security Findings Days Before the Incident
The timing of the emergency warning has drawn additional attention because BTCPay Server had released a major security update just three days earlier.
On October 29, 2026, the project released version 2.4.7 following vulnerability reports generated through Anthropic’s open-source security scanning initiative.
The update addressed 85 reported findings, broken down as follows:
- 1 critical
- 13 high-severity
- 52 medium-severity
- 19 low-severity
The findings emerged amid a wider expansion of AI-assisted vulnerability research. In 2026, systems developed by Anthropic, OpenAI and Google demonstrated increasingly advanced capabilities for identifying potential software weaknesses.
Anthropic’s scanning initiative reported more than 29,000 candidate vulnerabilities over six months, although only a portion underwent manual review.
The BTCPay Server incident illustrates the difference between finding vulnerabilities and securing software already running in production. A project can publish fixes, but independently operated servers do not update automatically.
An installation that remains on an older release can continue exposing users to weaknesses that developers have already addressed.
Merchants Take Payment Infrastructure Offline
The warning prompted businesses, including Coincards, to take BTCPay Server installations offline.
For merchants, the decision creates an immediate operational trade-off. Keeping a payment server available supports normal transactions, but leaving a potentially compromised hot wallet connected could expose funds to further unauthorized transfers.
Dorier also reiterated the importance of keeping hot-wallet balances limited to amounts operators can afford to lose.
Hot wallets are connected to online systems and are generally used for routine transactions. Their accessibility makes them useful for payment processing, but it also means they require careful security controls and limits on the funds held in them.
The reported incident has therefore renewed attention on wallet exposure, server access permissions, update practices and the separation of operational funds from larger reserves.
The Wider Security Challenge for Self-Hosted Crypto Payments
BTCPay Server’s model gives merchants direct control over Bitcoin payments, but self-hosting does not remove the need for continuous security management.
Operators must monitor software releases, apply patches, protect administrator credentials and assess the risks associated with connected wallets. Delayed updates can leave systems exposed even after developers have made a fix available.
AI-assisted security research may increase the speed at which vulnerabilities are discovered and reported. That can improve software security over time, but it also places pressure on maintainers and operators to review findings, release fixes and deploy updates quickly.
The challenge is particularly relevant to open-source infrastructure used by businesses that may not have dedicated security teams. The responsibility for applying a patch can fall on individual merchants or service operators.
Investigation Continues as Losses Remain Unconfirmed
The available updates did not include a confirmed estimate of stolen Bitcoin, a verified count of affected merchants or a complete account of the attack method.
Developers were preparing a fuller explanation, but no definitive incident-specific patch or all-clear had been announced in the supplied updates.
Until investigators publish more details, the relationship between the reported thefts, older software versions and previously disclosed vulnerabilities remains preliminary.
