BTCPay Server Warns of Hot Wallet Drains, Identifies Vulnerability Affecting Older Versions
BTCPay Server, the open-source Bitcoin payment processor used by merchants worldwide, has urged operators to shut down their instances following reports of unauthorized hot wallet withdrawals.
The warning was issued on November 1, 2026, after the project received reports that attackers were draining hot wallets connected to BTCPay Server instances.
In a post on X, the project said:
“We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers.“
It advised operators to shut down their servers using ./btcpay-down.sh while its investigation continued.
Older versions identified as the target
About six hours after its initial warning, BTCPay Server provided an update identifying an attack vector targeting instances running version 2.4.1 or older.
The project also reported no credible cases of hot wallet drains affecting version 2.4.7, its latest release at the time.
Affected operators were encouraged to share relevant information and server logs with the security team through security@btcpayserver.org.
What happened, and what remains unknown?
Several details about the incident remain undisclosed.
BTCPay Server has not published the total amount stolen, the number of affected instances or a complete explanation of how attackers gained access.
Reports suggest that attackers obtained administrator access, although the exact method has not been established publicly.
It is also unclear whether the incident is connected to a vulnerability patched in August.
Until the project publishes its postmortem, claims about the precise attack mechanism should be treated with caution.
Why hot wallets are particularly vulnerable
BTCPay Server supports hot wallets, which allow private keys to be stored on an internet-connected server. This makes it possible to sign outgoing transactions automatically.
However, it also creates a significant security risk.
If an attacker compromises the server, they may gain access to the wallet’s private keys and steal its funds.
This is why BTCPay recommends keeping only small amounts in hot wallets.
Watch-only wallets work differently because they allow servers to monitor transactions without holding the private keys required to spend funds.
A second security incident in three months
The incident comes less than three months after BTCPay Server addressed another serious vulnerability in August.
That vulnerability exposed LND administrator macaroon credentials, potentially allowing attackers to access connected Lightning wallets.
BTCPay addressed the issue in version 2.4.2 and said that on-chain wallets, including hot wallets, were not affected by that particular vulnerability.
Whether the latest incident is connected to the August vulnerability remains unknown. The project has not confirmed a relationship between the two incidents.
What BTCPay operators should do
Operators should take the following precautions:
Shut down vulnerable instances: Follow BTCPay’s shutdown instructions if running version 2.4.1 or older.
Update their installations: Move to version 2.4.7 or the latest security release before restarting.
Protect wallet funds: If a hot wallet was potentially compromised, assume its private keys are exposed and move remaining funds to a wallet whose keys were never stored on the affected server.
Review Lightning credentials: Check access logs and rotate credentials where compromise is suspected.
Preserve server logs: Share relevant evidence with BTCPay’s security team.
Review administrator access: Investigate unfamiliar accounts and suspicious login activity.
Updating the software is important, but it does not automatically reverse a compromise that has already occurred.
What this means for African Bitcoin merchants
BTCPay Server is an important part of the self-hosted Bitcoin payment ecosystem. Merchants, community projects and payment service providers use it to accept Bitcoin without depending entirely on third-party payment processors.
For African operators, the incident is a reminder that running independent Bitcoin infrastructure comes with security responsibilities.
Self-hosting provides greater control over payments and financial infrastructure, but that control also means operators must take responsibility for updates, access management, backups and wallet security.
The lesson is not to abandon self-hosted infrastructure. It is to operate it responsibly.
As Bitcoin adoption grows across Africa, security must become an equally important part of building payment infrastructure.
Africa Bitcoin News will update this report as more information becomes available.
For official updates, follow @BtcpayServer.