BTCPay Server Traces Hot Wallet Drains to Pre-2.4.2 Installations
BTCPay Server urged operators on November 2 to shut down instances after reports of attackers draining Bitcoin hot wallets. The project later narrowed the suspected attack vector to versions 2.4.1 and older, and said it has no credible drain reports for release 2.4.7.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
Shutdown Warning and Scope
BTCPay Server, the open-source self-hosted Bitcoin payment processor, asked operators on November 2 to temporarily shut down their instances after receiving reports of unauthorized sweeps of connected hot wallets. The initial instruction, which ran the ./btcpay-down.sh script, applied to all users while the team worked to determine how attackers were gaining access.
A follow-up incident response update narrowed the suspected attack vector to installations running version 2.4.1, released July 23, 2026, or earlier. The project said it has no credible reports of hot wallet drains involving version 2.4.7 and again urged operators to keep their software updated.
Conflicting Accounts of the Affected Versions
The sources differ on the exact cutoff. The project's advisory names version 2.4.1 and older as the affected range. Co-founder Nicolas Dorier, in a separate statement the same day, said the affected installations appeared to run releases from before 2.4.2, a narrower description that effectively excludes 2.4.1 from the vulnerable set only in the sense of how the boundary is phrased. Readers should treat the 2.4.1-and-older range from the official advisory as the operative guidance, and note that Dorier's framing points to the same practical line: upgrade beyond the 2.4.x point releases that preceded 2.4.2.
Dorier also said the project's own public servers, running 2.4.7, were not attacked. He said the attacker obtained administrator-level login on the affected instances, but the team had not yet established how that access was acquired.
Unknowns and Prior Incident
The project has not disclosed how much cryptocurrency was taken, how many servers were compromised, or how many users have reported losses. It has also not publicly described the technical weakness that enabled the intrusions.
The episode follows a breach in August, when BTCPay Server warned of an actively exploited vulnerability that could result in stolen funds and urged users to upgrade to version 2.4.2 or shut down their servers if they could not install the fix. Users who believe their servers were compromised have been asked to send incident details and system logs to the project's security contact.
What Operators Are Being Asked to Do
The project's guidance is to run the latest release, confirm the installed version, and submit logs if compromise is suspected. Hot wallets remain exposed when attackers obtain administrative control, since they can initiate transactions from connected wallets, so the fact that the root cause is still unpublished means operators on older builds have no fix-specific detail beyond the version upgrade.
Why It Matters
For Traders
Losses are unquantified and the project has not published totals, so price impact for Bitcoin is unlikely to be meaningful in the next few days.
For Investors
The incident is a self-custody and operational-security story for a niche payment tool, not a change to Bitcoin's base-layer risk profile.
For Builders
Any integration that relies on BTCPay Server hot wallets should verify its deployed version and treat administrator-level access as the critical boundary to harden.
This article is for information only and is not financial advice. Read the full disclaimer.
