BTCPay Server issues shutdown warning over hot wallet drain reports
CIE News ·
Based on reporting by Bitcoin.com News; not yet independently confirmed.
BTCPay Server urged merchants with hot wallets to shut down instances following unauthorized sweeps. Compromises appear limited to versions predating 2.4.2, while version 2.4.7 remains unaffected.
BTCPay Server issued an emergency shutdown warning on November 1, 2026, after receiving reports of unauthorized attackers sweeping Bitcoin (BTC) from self-hosted merchant hot wallets. Operators were instructed to halt their deployments immediately using the shutdown command while developers investigate the incidents, according to Bitcoin.com News. Total losses and the number of affected users have not been disclosed.
Founder Nicolas Dorier stated that preliminary findings link the compromises to installations operating on releases predating version 2.4.2. Dorier noted that attackers appeared to gain administrator access, whereas demonstration and public nodes running the updated version 2.4.7 have not been attacked.
The alert came days after BTCPay Server released version 2.4.7 on October 29 to patch 85 security vulnerabilities discovered during an AI-assisted security review. Investigators have not yet confirmed the precise entry mechanism used in the reported wallet thefts.
Key facts
- Emergency shutdown advisory
- Versions prior to 2.4.2 affected
- Version 2.4.7 unaffected
- 85 flaws patched on Oct. 29
Read the original at Bitcoin.com News