BTCPay Server hot wallets drained: what merchants must do now

BTCPay Server told merchants to shut down after reports of drained bitcoin hot wallets. What is known, who is at risk and the steps to take right now.

2026-11-02

Around 22:25 UTC on November 1, 2026, BTCPay Server, the free, self-hosted bitcoin payment processor used by merchants and nonprofits, posted an urgent notice: it was receiving reports of hot wallets being swept by unauthorized attackers. Operators were told to shut down with ./btcpay-down.sh and stay offline until the investigation ends.

What do we know about the BTCPay hot wallet drains?

No loss total or count of affected merchants had been published. Founder Nicolas Dorier's preliminary findings link the compromises to versions older than 2.4.2, with attackers apparently gaining administrator access; the project's own servers on 2.4.7 were not hit. Reporters caution that this does not prove updated installations are safe, since the entry route is still unknown. Merchants such as Coincards took their instances offline.

Is it linked to the August flaw?

Unconfirmed. In August, a flaw fixed in 2.4.2 let unauthenticated attackers obtain LND credentials and drain Lightning nodes; developers said on-chain wallets were not exposed. On October 29, version 2.4.7 fixed 85 security findings (1 critical, 13 high) reported by Anthropic's open-source scanning program, with no confirmed link to the current thefts.

What should BTCPay operators do now?

Shut down the instance and wait for an official all-clear.
Check the hot wallet balance on a block explorer; if funds remain and your seed is safe, move them to a fresh wallet created off the server.
Rotate admin passwords, enable 2FA, review users and API keys, and preserve logs.
When back, run the latest version and prefer a watch-only setup with keys kept off the server.
Keep only what you can afford to lose in a hot wallet.

Beware of anyone offering to recover funds: that is the recovery scam. See also the Binance hack, our Crypto section and the Radar.

Who is at risk?

Anyone running their own BTCPay Server instance with an active hot wallet, meaning the private keys sit on the server: online stores, nonprofits taking donations, service providers and hosts who run the software for clients. Setups that use a watch-only wallet, where the server only knows the public key and signing happens on a hardware or cold wallet, are far less exposed, because the server cannot move funds on its own. Shoppers who already paid a merchant in bitcoin do not lose that payment, but the merchant may have lost its accumulated balance.

Why self-hosted software is hard to patch

BTCPay is self-hosted, so every operator must update their own server. As coverage of the incident noted, publishing a fix does not update the machines that third parties run, a problem shared by any software a business installs and forgets. October 2026 was already a heavy month for the crypto industry, and attackers move quickly once a weakness becomes public.

Date	Event
Aug 2026	LND credential flaw fixed in 2.4.2; Lightning nodes drained
Oct 29, 2026	Version 2.4.7 fixes 85 findings
Nov 1, 2026	Hot wallet sweeps reported; shutdown ordered