The BTCPay Server hack exposed hot wallets on outdated self-hosted payment servers to theft, but investigators have not explained how attackers gained administrator access. The team says version 2.4.1 and older are in scope. Total losses remain unknown.
Key Takeaways
- BTCPay Server identified version 2.4.1 and earlier as in scope for the attack.
- The team reported no credible hot wallet drain reports for the latest release, version 2.4.7.
- Investigators have not disclosed total losses or how attackers obtained admin access.
- A hot wallet lets the server move funds using stored keys, putting its balance at risk if the server is compromised.
What happened in the BTCPay Server hack
BTCPay Server raised the alarm late on November 1 after reports of unauthorized attackers draining hot wallets. Cointelegraph reported that the project urged operators to shut down their servers while it responded. A follow-up identified version 2.4.1, released July 23, 2026, and older versions as targeted.
According to BeInCrypto, founder Nicolas Dorier said an attacker logged in as an administrator on affected servers. The team has not worked out how the attacker obtained access or disclosed a total loss figure. Investigators have found traces pointing to vulnerabilities that predate version 2.4.2.
In its November 2 update, the team said it had no credible reports of hot wallet drains from version 2.4.7, which it identified as the latest release. The initial shutdown warning was broad, but the later version-specific notice gives operators a clearer view of the reported exposure. It does not explain the intrusion or confirm the status of every server.
BeInCrypto’s investigation says hosting providers, including LunaNode, may have automatically shut down customer instances to limit attacks on older software. This was described as a possibility, not a confirmed action affecting every host. Cointelegraph’s report also said the thefts targeted older versions.
Background: why a BTCPay Server hot wallet matters
BTCPay Server is free, open-source payment processing software that merchants host themselves to accept Bitcoin, according to BeInCrypto. With a hot wallet, the server stores private keys and can send funds without the operator signing each transaction. As a result, someone with administrator access to a server using this setup can move its coins.
The BTCPay Server hack follows an earlier warning about a critical flaw patched in version 2.4.2 in August. BeInCrypto reported that the flaw could let remote attackers obtain Lightning node credentials and drain connected wallets, and that it was already being exploited at the time. The outlet described the current incident as at least the second theft in three months from instances running software older than 2.4.2.
The team’s version-specific notice says the attack vector targets 2.4.1 and older, while it has no credible reports of drains on 2.4.7. The investigation has not established how attackers gained administrator access. It has identified traces of vulnerabilities predating 2.4.2, but the available reporting does not say how those traces relate to the entry method.
Dorier said he runs version 2.4.7 with a hot wallet, but warned operators against keeping more funds in a hot wallet than they are prepared to lose, according to BeInCrypto. The incident report does not give a total for the funds taken. It also does not establish that every BTCPay Server installation was compromised.
Market reaction to the BTCPay Server hack
The available snapshot does not establish a clear, immediate Bitcoin price reaction to the incident. CoinGecko data at 07:13 UTC on November 2, 2026, showed Bitcoin slightly higher over 24 hours, while its weekly and monthly performance remained negative. These market-wide moves are not evidence that the incident caused a price change.
| Asset | Price at 07:13 UTC | 24-hour change |
|---|---|---|
| Bitcoin (BTC) | $78,099 | +0.30% |
| Ethereum (ETH) | $2,283.80 | +0.75% |
The Crypto Fear & Greed Index was 37, classified as Fear, on November 2, according to Alternative.me. This is a broad sentiment reading, not a measure of views on BTCPay Server. The thefts matter directly to merchants and server operators, but the available data does not establish wider market impact or say how much Bitcoin was taken.
What to watch next
An unresolved question is how attackers gained administrator access. Investigators have identified an affected version range and traces of older vulnerabilities, but have not tied those findings to a confirmed entry method. Further details, if disclosed, could clarify what the investigation has established.
Outstanding information includes an official loss estimate, further guidance on affected versions and any update to the team’s statement that it has no credible drain reports for version 2.4.7. BeInCrypto reported that the team asked operators to keep instances shut down while the investigation continued. The supplied reporting does not say when the investigation will conclude or when further guidance may be issued.
For merchants using BTCPay Server, the reported incident concerns hot wallets on older instances. BeInCrypto says the server stores keys itself in this setup, allowing it to send funds without an operator signing each transaction. The team’s version notice and investigation findings are the available information on the reported attack; they do not establish that all installations were compromised.
FAQ
Which versions are affected by the BTCPay Server hack?
The team identified version 2.4.1, released July 23, 2026, and earlier versions as targeted. On November 2, it said it had no credible reports of hot wallet drains on version 2.4.7.
How did attackers drain BTCPay Server wallets?
Investigators said attackers logged in with administrator access and swept hot wallets. They have not explained how the attackers obtained that access or disclosed the total funds taken.
Why can a hot wallet increase risk on a payment server?
A hot wallet stores keys on the server, allowing it to send funds without a separate operator signature for each transaction. If someone gains administrator access to the server, they may be able to move coins in the wallet.
Sources
- Is Your BTCPay Server Safe? What the Hot Wallet Drain Investigation Shows (BeInCrypto)
- BTCPay Server warns of hot wallet thefts running on outdated software (Cointelegraph)
This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrencies are highly volatile; always do your own research before investing.
For advertising inquiries, please email . [email protected] or Telegram
