BTCPay Server Hot Wallet Drain Hits Versions 2.4.1 and Earlier

BTCPay Server reported multiple unauthorized drains of Bitcoin hot wallets on self-hosted instances on the evening of November 1, 2026. The project instructed operators to shut down servers immediately using the command ./btcpay-down.sh while the team investigated. Affected installations ran version 2.4.1, released July 23, 2026, or earlier.

BTCPay Server Hot Wallet Drain Investigation Findings

On November 2, 2026, the incident response team confirmed an attack vector limited to versions before 2.4.2. No credible reports of similar drains have surfaced for operators running the current release, version 2.4.7. Founder Nicolas Dorier stated that attackers obtained administrator-level access on compromised servers, with traces pointing to vulnerabilities present in pre-2.4.2 code. The exact entry method remains under review.

Version 2.4.7, released October 29, 2026, addressed 85 security findings, including one critical and 13 high-severity issues identified through Anthropic’s open-source scanner. The update applies especially to multi-merchant deployments. Dorier noted that instances updated at least once since 2.4.2 show no cause for concern. Affected operators have been asked to send logs and details to security@btcpayserver.org.

Some hosting providers, including LunaNode, automatically suspended vulnerable customer instances. The project continues to recommend that operators store only funds they can afford to lose in hot wallets. A detailed follow-up blog post is expected once additional technical information is verified.

Context and Prior Security Updates

This marks the second reported incident involving pre-2.4.2 versions within three months. An August 2026 vulnerability, patched in version 2.4.2, permitted remote theft of Lightning node credentials but did not extend to standard on-chain hot wallets. No aggregate figures for affected operators or total stolen funds have been released.

BTCPay Server functions as an open-source Bitcoin payment processor that merchants and service providers deploy on their own infrastructure. The repeated focus on outdated installations underscores the importance of timely updates for self-hosted software handling cryptocurrency funds. Operators are advised to review their current version against the latest release on the project’s GitHub repository and apply updates without delay.

Immediate Steps for Operators

Users on versions 2.4.1 and earlier should verify their installation status and apply version 2.4.7. Those who have already updated since 2.4.2 can confirm their setup remains secure. The project has not issued any broader market-wide alerts beyond directing attention to the specific versions at risk.

Technical details continue to emerge as the investigation proceeds. All operators are encouraged to monitor official project channels for the forthcoming blog post that will expand on the identified attack vector and mitigation measures.