Open-source Bitcoin payment processor BTCPay Server says it is receiving reports that hot wallets have been emptied by unauthorized attackers
Open-source Bitcoin payment processor BTCPay Server posted on X on November 1, 2026, that it is receiving reports that hot wallets on its servers have been emptied by unauthorized attackers. The team urged any operators running an instance to shut it down until the investigation is complete.
BTCPay Server wrote in the post: “We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers. If you are running an instance, please shut it down (./btcpay-down.sh) until we complete our investigation.”
The post did not disclose the specific amount of losses, the number of affected instances, the versions or configurations involved, and did not announce a patch. The shutdown recommendation was not limited to a specific version. The warning came after the project released emergency version 2.4.7 on October 29, which fixed one critical and several medium-risk vulnerabilities, and after an incident in August involving leaked LND credentials that led to stolen funds from Lightning nodes. In the August incident, BTCPay Server said that its standard on-chain wallets, including hot wallets, were not affected.
Original source:
Title: We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers... Publisher: BTCPay Server (@BtcpayServer) Publication date: 2026-11-01 URL: https://x.com/BtcpayServer/status/2117020340815819262 Source nature: official project post Verification status: full text of the original post was read for this report, verification date 2026-11-01 Supporting content: BTCPay Server said it is receiving reports that hot wallets have been emptied by unauthorized attackers, and urged operators to run ./btcpay-down.sh to shut down instances until the investigation is complete
ABAB AI Insight
BTCPay Server is a free, open-source, self-hosted Bitcoin payment processor that allows individuals and merchants to accept Bitcoin and Lightning payments directly, without third-party intermediaries or fees. Its hot wallets are wallets that hold private keys on the server and can sign transactions online, unlike watch-only wallets that store only extended public keys. In this incident, the official statement only confirmed that it was “receiving reports” and has not yet disclosed the total losses, the number affected, or the root cause, nor has it limited the issue to any specific version.
This incident is different from the vulnerability in August 2026. At that time, the vulnerability allowed unauthenticated remote attackers to obtain LND (Lightning Network Daemon) .macaroon credential files, thereby taking control of nodes and moving funds; version 2.4.2 fixed that issue, and the company explicitly said its standard on-chain wallets, including hot wallets, were not affected by that vulnerability. The current reports directly point to hot wallets being emptied and occurred after version 2.4.7, which was released on October 29 and fixed multiple vulnerabilities, suggesting a new attack vector or remaining risk that was not fully mitigated.
For self-hosted payment software, hot wallets place private keys on internet-reachable servers. Once an instance is compromised or credentials leak, attackers can directly transfer funds. The official recommendation to shut down instances immediately is a temporary measure to reduce further losses before the investigation is complete. The actual impact will still depend on whether operators have updated to the latest version, whether they use hot wallets, and whether other exposure points exist. Before the investigation results are released, it cannot be confirmed whether the attack has stopped or whether it is limited to a specific configuration.
ABAB News · Cognitive Law
“Receiving reports” from the official side does not mean the full scope of impact or the root cause has been confirmed; the shutdown recommendation is a temporary measure during the investigation.
Hot wallets and watch-only wallets, as well as on-chain wallets and Lightning node credentials, are different attack surfaces; the scope of previous incidents cannot be directly applied to this report.