The Bitcoin Beacon
The free software that lets shops take bitcoin without a middleman says attackers emptied hot wallets on servers that had skipped months of updates.
At 22:25 UTC on Sunday, the BTCPay Server project posted an alert its users had not seen before: “We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers.” Its instruction was one command long. If you run an instance, “please shut it down (./btcpay-down.sh) until we complete the investigation.”
BTCPay is free, open-source software that lets shops, charities and websites accept bitcoin on their own server, with no payment company holding the money. Less than six hours later the project said it had found how the attackers got in — and which servers they could reach.
Why it matters: BTCPay is how merchants take bitcoin without a payment company in the middle. The trade-off is that the merchant is also the security team.
A core contributor, posting as r0ckstardev, was blunter than the official alert: “Not a drill: shut down your BTCPay Server if you have a hot wallet.” About two hours after the first post, founder Nicolas Dorier said the reports appeared to involve releases older than version 2.4.2, and that the attacker had logged in to affected servers as an administrator, according to CoinDesk.
At 04:07 UTC on Monday the project narrowed it further. “Our incident response investigation identified an attack vector targeting instances running versions 2.4.1 (Jul 23, 2026) or older,” it wrote. “We have no credible reports of hot wallet drains for users running the latest 2.4.7 release.” It asked anyone affected to send details and logs to security@btcpayserver.org.
Some merchants never had to act. Hosting companies that run BTCPay for customers switched older instances off on their own; the project thanked LunaNode and “other hosting providers” for doing so.
BTCPay has not said how much bitcoin was taken or how many servers were hit.
A BTCPay merchant can keep funds two ways. In a watch-only setup the seed — the master key — stays on a separate device, and the server can see payments but not move them. In a hot wallet the seed lives on the internet-connected server itself, so BTCPay can sign payouts and refunds automatically. That convenience is the exposure: whoever controls the server as an administrator controls the coins. Watch-only setups are not believed to be affected, TFTC reports.
The servers that were emptied had been left on a version from July.
This is not BTCPay’s first emergency this year. In August, version 2.4.2 closed a flaw that attackers were already using to drain merchants’ Lightning nodes; on-chain hot wallets were not affected then. On October 29 the project shipped 2.4.7, an emergency update fixing one critical and several medium-severity flaws found with Anthropic’s open-source scanning tool — part of the 85 problems that scan turned up, as the Beacon reported on October 30. CriptoNoticias counts Sunday as the second severe incident in a short span and quotes Ledger’s chief technology officer, Charles Guillemet, calling the run of recent breaches frightening.
The common thread is the date on the box. Every drain reported so far hit software from July or earlier — at least six releases behind.
For a shop that switches off, the cost is a few hours without bitcoin checkout. For one that doesn’t, it is whatever sits in the hot wallet. Self-hosting removes the payment company; it doesn’t remove the need for someone to press update.
The investigation is open; BTCPay has published no loss total, victim count or full technical write-up. Version guidance is as posted by the project at 04:07 UTC on November 2. BTCPay is revisited inside the five-day cooldown because drains are a material change from the October 30 story. The Beacon’s publisher uses Claude, Anthropic’s model, in its production. Not security advice for any specific setup.
Free. Five minutes. No hype.
Subscribe free