BTCPay Server Hack Drains Merchant Hot Wallets Tied to Pre-2.4.2 Versions
BTCPay Server, the open-source Bitcoin payment processor, has warned operators after reports of attackers withdrawing funds from merchant hot wallets. The team says the attack targeted instances running version 2.4.1 or older, while the latest 2.4.7 release has no credible reports of drains.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
What Happened
BTCPay Server, the free, self-hosted Bitcoin and Lightning payment processor, has received reports of attackers withdrawing funds from merchant hot wallets. On November 1, the project issued an emergency notice asking operators to temporarily shut down their payment servers while its team investigated the incidents. The project has not disclosed how much was lost or how many servers were affected.
Where the Attack Vector Points
The project's investigation has identified instances running version 2.4.1, released on July 23, 2026, or older as the target. Sources differ on the exact cutoff: Bitcoinist's coverage describes the reports in general terms, while CryptoPotato, citing the team, says the affected builds are those at or before 2.4.1. Founder Nicolas Dorier said in a post that public servers on 2.4.7 were not attacked and that the reports appear to concern instances before 2.4.2. Dorier added that the attacker logged in as admin on those instances, and that the team is still working out how this was achieved.
Prior Incident and Open Questions
The episode follows a vulnerability disclosed about three months earlier that let attackers obtain LND admin macaroon credentials from affected instances and access connected LND wallets. Dorier said the team has traces indicating pre-2.4.2 vulnerabilities were used this time, and promised a follow-up blog post. Affected users have been asked to update to 2.4.7 and send details and logs to [email protected].
Why It Matters
For Traders
Exposure is limited to self-hosted instances on older builds, so direct price impact on Bitcoin is unlikely, but merchant-facing payment reliability is in question for the next few days.
For Investors
Repeated wallet-compromise incidents in self-hosted payment tooling raise the operational risk premium on merchant Bitcoin acceptance that does not rely on custodial processors.
For Builders
Any stack embedding BTCPay or exposing LND admin macaroons should audit credential scope and confirm instances are on 2.4.7 or later.
This article is for information only and is not financial advice. Read the full disclaimer.
