BTCPay Server Warns of Bitcoin Theft, Urges Shutdown of Outdated Servers

BTCPay Server, an open-source bitcoin payment platform, has warned users about attacks targeting older versions of its software. The warning came after hackers reportedly stole bitcoin from users' hot wallets. The project has advised operators of vulnerable servers to take them offline and update their software to prevent further losses.

The first warning was issued on November 1, after the development team received reports of unauthorized withdrawals from BTCPay Server hot wallets. The team initially urged all operators to shut down their servers using the ./btcpay-down.sh command while it investigated the incident.

BTCPay Server allows businesses and online stores to accept bitcoin payments directly into their own wallets without relying on payment processors or other middlemen. Users run the software on their own servers or through hosting providers.

However, this setup can create security risks, especially for users who keep hot wallets on their servers.

A hot wallet is a digital asset wallet connected to the internet. BTCPay Server allows users to store their wallet seed phrases on their servers. This enables the software to sign and approve outgoing transactions automatically.

According to BTCPay's documentation, the software can "automatically use the seed stored on a server to sign" transactions.

This feature makes it easier for businesses to process payments, but it also creates a security risk. If hackers gain access to a server that stores a wallet's seed phrase, they may be able to steal its funds.

In the latest incident, attackers reportedly managed to gain administrator access to affected BTCPay Server installations. This gave them access to the servers and allowed them to drain connected hot wallets.

The project has not explained how the attackers obtained administrator access. It has also not revealed how many users were affected or how much bitcoin was stolen.

After investigating the reports, BTCPay Server identified an attack method targeting installations running version 2.4.1, released on July 23, 2026, or earlier.

The team said it had received no credible reports of hot wallet thefts involving users running the latest version, 2.4.7.

BTCPay founder Nicolas Dorier also confirmed that the project's own public servers, which run version 2.4.7, were not attacked.

In an earlier update, Dorier said the attackers had managed to log in as administrators on affected servers. However, the team was still trying to determine how they gained access.

The investigation also found evidence that vulnerabilities in versions older than 2.4.2 may have been used in the attacks. BTCPay has urged users to keep their software updated. Anyone still running version 2.4.1 or an older release should take their server offline as soon as possible.

Users who believe their servers have been compromised should rebuild their installations and move any remaining funds to newly created wallets. The team has also asked affected users to send incident details and server logs to [email protected].

Unlike traditional payment platforms, BTCPay Server does not control all the servers running its software. Businesses and individuals install and manage their own instances, meaning the project cannot shut down every vulnerable server itself.

To reduce the risk of further thefts, the team contacted hosting providers and asked them to take potentially affected servers offline. BTCPay thanked LunaNode and other hosting providers for responding quickly to the warning and helping protect users.

The latest attack follows a separate security incident involving BTCPay Server in August 2026.

At that time, hackers exploited a vulnerability in older versions of the software to steal credentials belonging to Lightning Network nodes running LND. These credentials allowed attackers to access connected Lightning wallets and withdraw funds.

BTCPay fixed that vulnerability in version 2.4.2, released on August 7. While the August incident involved Lightning wallets, the latest reports concern on-chain hot wallets.

More recently, on October 29, the developers released version 2.4.7 after identifying and fixing 85 security issues with the help of Anthropic's OSS Scanner. The update included one critical, 13 high-severity, 52 medium-severity, and 19 low-severity fixes.

However, the project has not confirmed whether the latest thefts are connected to any of the issues addressed in that update.