Bitcoin (BTC) Merchants Told to Shut Down as BTCPay Wallets Drained

By Nodora News · 2 November 2026 · Updated 2 November

BTCPay Server told Bitcoin (BTC) merchants to shut down after hot wallets were drained on versions 2.4.1 and older; the latest 2.4.7 has no reported drains.

BTCPay Server, the free open-source software that thousands of merchants use to accept Bitcoin (BTC) without a middleman, told every operator to shut down their servers late on Sunday, November 1 (UTC) after reports that attackers were sweeping funds out of hot wallets. By Monday the project said it had found the attack vector: instances running version 2.4.1 or older. No loss figure or count of affected servers has been published yet.

Key takeaways

• BTCPay Server asked operators to run `./btcpay-down.sh` and stay offline after reports of hot wallets being drained.
• The project says the attack targeted versions 2.4.1 (released July 23, 2026) or older.
• It has no credible reports of drains on the latest 2.4.7 release, and its own public servers were not hit.
• Attackers logged in as admin on affected servers; founder Nicolas Dorier says older, already-patched flaws appear to have been used.
• Bitcoin itself was not compromised. BTC trades near $78,400, up about 0.8% on the day.

What happened to BTCPay Server

At about 22:25 UTC on Sunday (9:25am Monday in Melbourne), BTCPay Server posted an urgent warning on X. It said it was receiving reports of hot wallets on BTCPay instances being "swept", meaning the coins were moved out in one go, and asked anyone running an instance to shut it down until the investigation was complete.

That request matters because of how BTCPay works. It is self-hosted: each business runs its own copy on its own server and receives bitcoin straight into its own wallet. There is no central company holding funds and no master switch. If something goes wrong, every merchant has to act individually, which is why the team's only option was to ask them all to power down.

About two hours later, Dorier said the project's public servers, which run version 2.4.7, had not been attacked, and that the reports appeared to involve releases older than 2.4.2. He added that the attacker had managed to log in as an administrator on the affected instances.

Which BTCPay versions are affected

On Monday afternoon (UTC morning), BTCPay Server published an update from its incident response:

• Affected: instances on version 2.4.1 (July 23, 2026) or older.
• No credible reports of drains: the current 2.4.7 release.
• If you were hit: send details and logs to the project's security email so the team can investigate.

Dorier said there was "no reason to panic" for operators who have updated at least once since 2.4.2 came out, but told affected users to treat their whole server as compromised, not just the wallet seed. He also posted the attacker's Bitcoin address and a Litecoin (LTC) address linked to the thefts, so on-chain sleuths can follow the money. A fuller technical blog post is promised.

Some hosting providers, including LunaNode, shut down customer instances automatically to stop older versions being exploited, so merchants using a host may find their store offline even if they did nothing.

Why hot wallets are the weak point

A "hot wallet" is a wallet whose secret seed phrase sits on an internet-connected machine. BTCPay offers this so a server can sign and send payments by itself, for example to process refunds or payouts automatically. Its own documentation flags the feature with a danger warning, because anyone who takes control of the server can also move the coins.

That appears to be exactly what happened here. Once the attacker had admin access, the hot wallets on those servers could be emptied without the owner approving anything on a separate device.

This is not BTCPay's first brush with an older-version problem. Earlier this year the project fixed a critical flaw in version 2.4.2 that let outsiders grab credential files for LND, a popular Lightning Network node, and confirmed that funds had been stolen through it. Dorier said the current incident does not look like a brand-new vulnerability, suggesting servers that never applied that update stayed exposed.

Market reaction: Bitcoin shrugs it off

The incident hits individual merchants, not the Bitcoin network, and prices barely moved. On OKX on Monday afternoon:

• Bitcoin (BTC): about $78,430, up roughly 0.8% in 24 hours
• Litecoin (LTC): about $55.90, down roughly 0.3%

BTC has spent the past few days recovering after the record $6.3 billion Binance hack, and this news has not changed that picture. You can follow live prices on Nodora Charts.

What to watch next

• The loss total. BTCPay has not said how much was taken or how many servers were hit. Watch the attacker addresses for the size of the haul.
• The technical write-up. The promised blog post should explain exactly how attackers got admin access on old versions.
• Whether 2.4.7 stays clean. So far there are no credible reports of drains on the latest release.
• Merchant fallout. Small shops that rely on BTCPay may be offline until they update and rebuild their servers.

For anyone running BTCPay Server, the project's advice is simple: update to the latest version, review logs, rotate anything stored on the server, and keep only small amounts in a hot wallet. As Dorier put it, don't keep more there than you are ready to lose.

For more on the wider security picture this week, see how Binance hackers have been laundering funds through Tron.

#Bitcoin #BTCPay Server #Hack #Security #Crypto News

This article is general information, not financial advice.