BTC
ETH
SOL
XRP
BNB
TON
DOT
LTC
POL
HBAR
NEAR
ARB
UNIBTCPay Server tells operators to shut down after hot wallet theft reports
BTCPay Server urged operators to take self-hosted payment servers offline on 1 Nov 2026 after reports that attackers were draining Bitcoin from connected hot wallets. Founder Nicolas Dorier linked the compromises to versions older than 2.4.2.
Why it matters: Self-hosted Bitcoin payment servers hold merchant funds in hot wallets, and the reported losses show that publishing fixes does not update independently operated installations.
Key points
- BTCPay Server issued the shutdown warning at about 22:25 UTC on 1 Nov 2026, telling operators to run ./btcpay-down.sh.
- Nicolas Dorier's preliminary findings point to deployments running software older than version 2.4.2, while public servers on 2.4.7 were not attacked.
- Version 2.4.7, released on 29 Oct, fixed 85 flaws found through Anthropic's open-source security scanning initiative.
BTCPay Server told operators to shut down their self-hosted payment servers on 1 Nov 2026 after reports that attackers were draining Bitcoin from connected hot wallets. The project's official account posted the warning at about 22:25 UTC, and a core contributor called it "not a drill". Operators were told to run the ./btcpay-down.sh command while investigators worked out what had happened.
The open-source software lets merchants accept Bitcoin without a conventional payment intermediary, with each operator hosting the software and managing its wallet infrastructure. Founder Nicolas Dorier said in preliminary findings that the affected deployments ran software older than version 2.4.2, and that attackers had gained administrator access. Public and demonstration servers on version 2.4.7 had not been attacked, he indicated.
Older versions blamed
The timing drew attention. On 29 Oct the project released version 2.4.7, fixing 85 findings from Anthropic's open-source security scanning initiative, including one critical and 13 high-severity issues. The project had also patched a separate flaw in August, fixed in 2.4.2, that let unauthenticated attackers obtain Lightning Network Daemon authorisation tokens.
Businesses including Coincards took their BTCPay installations offline after the warning, weighing payment availability against the safety of funds in connected wallets. Dorier repeated that operators should keep hot-wallet balances to amounts they can afford to lose. Developers had given no total loss figure, no incident-specific patch and no all-clear, and were preparing a fuller explanation.
What to watch: Developers were preparing a fuller explanation of the incident, with no incident-specific patch or all-clear announced.
Live updates on NewsFeeds:BitcoinDesk editor: Keshav Aggarwal (accountable for this page; this summary was not edited by hand)
How this was produced: an AI model wrote this summary of Bitcoin.com News’s report, which we credit and link above. Read our Editorial and AI policy. Spotted a mistake? See Corrections.
Not investment advice. Read the risk disclaimer.