BTCPay Server Orders Emergency Shutdown As Hot Wallet Attacks Drain Operators’ Bitcoin

• BTCPay Server issued an emergency warning on Nov 1 ordering all users to shut down instances
• Foundation & Citadel21 reported drained wallets, some incidents occurring before the public alert
• Investigation narrowed threat to version 2.4.1 & older; version 2.4.7 shows no credible drain reports
• Attackers gained administrator access to compromise servers; the access method remains unknown
• Hosting provider LunaNode pre-emptively shut down affected instances as a precaution

Emergency Warning & Affected Versions

BTCPay Server, the widely used open-source Bitcoin payment tool, issued an emergency warning on November 1 after receiving reports of attackers draining hot wallets across operator instances.

The project told all users to shut down servers immediately by running the btcpay-down.sh shutdown script and remain offline pending investigation.

UPDATE: https://t.co/kLmxewna4W

— BTCPay Server (@BtcpayServer) November 2, 2026

A follow-up post on November 2 narrowed the scope, reporting no credible hot wallet drain reports for users running version 2.4.7, while identifying version 2.4.1 released July 23, 2026, and older versions as the likely targets. The project’s own public servers running 2.4.7 were not affected.

Known Victims & Attack Method

Hardware wallet maker Foundation and Bitcoin publication Citadel21 both confirmed their nodes had been swept, with some incidents occurring hours before the public alert was issued.

Update on my part: Our public servers were not attacked (on 2.4.7), it seems reports are on before 2.4.2.

The attacker managed to log in as admin on those instance, we are still trying to figure out how.

— Nicolas Dorier (@NicolasDorier) November 2, 2026

Co-founder Nicolas Dorier confirmed attackers logged in with administrator privileges on compromised servers, though the method of obtaining that access remains unknown.

Because BTCPay Server’s self-hosted model means each merchant runs an independent instance, the project cannot centrally shut down servers and must rely on each operator to act. Affected users were asked to send incident details and server logs to the BTCPay security team for investigation.

Context & Previous Vulnerabilities

BTCPay Server experienced a separate critical vulnerability in August 2026 in which attackers exploited a flaw in versions before 2.4.2, exposing LND admin macaroon credentials and enabling attackers to control connected Lightning nodes. That incident prompted the project to offer a recovery bounty of 10% of recovered funds capped at 3 BTC.

The November incident affects on-chain hot wallets rather than Lightning nodes and is distinct from the August flaw. Hosting providers including LunaNode pre-emptively shut down certain hosted instances as a precaution before their operators could act independently.

Stay informed with the latest trends in Web3, blockchain innovation, and cybersecurity updates at 3verseTV

You need to login in order to Like