BTCPay Server has issued an emergency security warning after reports surfaced of attackers draining Bitcoin from hot wallets hosted on its payment infrastructure, urging operators to shut down their servers while investigators work to determine the extent of the compromise.

The alert, published on November 1, initially applied to all installations. Subsequent findings have since narrowed the suspected attack vector to BTCPay Server versions 2.4.1 and earlier, and the project says it has received no credible reports of hot wallet thefts involving its latest 2.4.7 release. The total amount stolen, the number of affected merchants, and the exact method used to compromise the servers remain undisclosed.

Wallet Drains Traced to Outdated Software

BTCPay Server told operators to immediately take their instances offline using the ./btcpay-down.sh command after reports emerged of unauthorized withdrawals from internet-connected wallets.

The open-source payment processor allows merchants to accept Bitcoin and Lightning Network payments without relying on centralized custodians. Its optional hot wallet functionality, however, stores signing credentials on the server itself, potentially exposing funds if attackers gain administrative access. Hot wallets keep those keys online so payments can be processed automatically, while cold storage keeps them offline — a tradeoff that leaves self-custodied merchants with no intermediary standing between their keys and an attacker.

Founder Nicolas Dorier said preliminary investigations showed that attackers had successfully logged into affected servers as administrators, although the method used to obtain that access is still being examined. The compromised installations appeared to be running versions released before August 2026, when BTCPay Server introduced version 2.4.2 to address several security weaknesses.

The team subsequently identified an attack vector affecting versions 2.4.1 and older, while noting that its own publicly accessible servers running the latest release had not been compromised. Because the software is self-hosted, however, patching depends on individual operators acting on the project's advisories — no central provider can update the servers on merchants' behalf.

The findings came days after BTCPay Server released version 2.4.7 on October 29, addressing 85 security findings identified through Anthropic's open-source security scanning program. Those fixes covered one critical, 13 high-severity, 52 medium-severity, and 19 low-severity issues spanning authentication, payment processing, API access, and other components. The release is available on GitHub, and the project shared its warning via X.

Although the latest release has no confirmed hot wallet losses attached to it, the investigation has not yet established which specific vulnerability enabled the November attacks.

Bitcoin Payment Infrastructure Faces Renewed Security Pressure

The incident follows an August breach involving BTCPay Server's Lightning Network integration. Attackers previously exploited a vulnerability that allowed unauthorized access to LND administrative credentials, potentially enabling them to control connected Lightning nodes and transfer funds. That weakness was identified during a broader Bitcoin security review and patched in version 2.4.2, and the earlier incident affected LND-connected funds rather than BTCPay Server's standard on-chain hot wallets.

Security concerns have also extended to other Bitcoin applications. In August, Core Lightning urged node operators to disconnect while developers prepared security updates. More recently, Electrum patched an actively exploited wallet vulnerability after attackers manipulated transaction data to redirect Bitcoin payments.

BTCPay Server is now urging affected operators to come forward with relevant logs and incident details. Users are advised to keep installations updated, minimize funds stored in hot wallets, and transfer remaining assets to secure cold storage where necessary. Some hosting providers have proactively suspended customer instances running vulnerable software to prevent further losses.

The investigation remains ongoing, with no confirmed recovery figures or complete technical explanation published so far. While the latest software appears unaffected by the identified attack vector, the incident underscores the risks of outdated self-hosted payment infrastructure, particularly when private keys remain accessible on internet-connected servers. Attention now turns to whether the project publishes a full technical post-mortem and how many affected merchants report losses as logs come in.