BTCPay Server hot wallets drained as founder urges operators to update
BTCPay Server said it is receiving reports of hot wallets on some instances being swept by unauthorized attackers, prompting an urgent warning to operators. In a post on the project’s official X account, the team told users to shut down their servers while it investigates the incident.
🚨 We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers.
If you're running an instance, please shut it down (./btcpay-down.sh) until we complete the investigation.
— BTCPay Server (@BtcpayServer) November 1, 2026
Founder Nicolas Dorier later said users who have updated at least once since version 2.4.2 “have no reason to panic,” while urging frequent updates and cautioning operators not to keep too much cryptocurrency in hot wallets. He also said the project will publish a blog post with more details.
The warning matters because BTCPay Server is used by merchants and other operators to accept bitcoin payments, and the affected funds appear to be connected to internet-facing hot wallets rather than cold storage. Dorier’s version guidance suggests the investigation has already identified a threshold relevant to the incident, although the project has not yet laid out the full technical path behind the unauthorized access.
For now, the main advice from the project is operational rather than speculative: update the software, limit balances kept online, and keep instances offline if they may be exposed while the investigation continues.
