BTCPay Server, the free and open-source software that businesses use to accept Bitcoin payments, urged operators on Sunday to switch off their instances after reports that attackers were sweeping hot wallets connected to servers running the platform.

The project later said the attack targeted instances running version 2.4.1 or older, and that it had received no credible reports of drained hot wallets among users of the latest release, version 2.4.7.

The warning was posted on X at 5:25 p.m. ET on November 1:

🚨 We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers.

If you're running an instance, please shut it down (./btcpay-down.sh) until we complete the investigation.

— BTCPay Server (@BtcpayServer) November 1, 2026

The command cited in the alert, ./btcpay-down.sh, shuts down a running BTCPay instance. About two hours later, BTCPay founder Nicolas Dorier said the reports appeared to involve releases older than version 2.4.2, and that the attacker had logged in to affected servers with administrator access.

Later on Sunday, the project said in a follow-up post on X that its investigation had identified an attack vector targeting instances running version 2.4.1, released on July 23, or older. "We have no credible reports of hot wallet drains for users running the latest 2.4.7 release," it said, urging everyone to keep their software updated and asking affected users to send details and logs to its security team.

Some hosting providers, including LunaNode, have shut down BTCPay instances automatically to stop older versions from being exploited, the project said. BTCPay has not disclosed how many servers were affected or how much Bitcoin was taken. The full scale of the incident remains unclear. The project's initial alert tied the shutdown advisory to the completion of its investigation, so affected operators were waiting on the review's outcome before bringing instances back online.

Hot wallets and BTCPay's emergency update

Because BTCPay is self-hosted, each merchant runs the software on their own server, and there is no central operator with the ability to switch instances off across the network. That distributed setup also leaves patching to individual operators, since updates reach the network only as each server owner applies them. Merchants can choose to run a hot wallet, which stores the wallet's seed on the internet-connected server so it can sign transactions automatically. Sweeping — the maneuver described in the project's alert — transfers a wallet's entire balance to an address the attacker controls. Cold wallets, by contrast, keep signing keys offline and cannot sign transactions automatically. BTCPay's own documentation labels the hot wallet feature "DANGER" and warns that it "comes with security implications."

The attacks come days after BTCPay released version 2.4.7 on Thursday as an emergency update fixing one critical and several medium-severity vulnerabilities, which the project said were brought to its attention through Anthropic's frontier open-source software scanner. The project has not said whether the attackers exploited any of those flaws.

It is not the first security scare for the project this year. In August, BTCPay warned that a critical vulnerability in all versions before 2.4.2 was being actively exploited, and told users to update or shut down their servers. Supporters of the project later funded a recovery bounty that promised 10% of any stolen funds returned to victims, with the payout capped at 3 BTC.