In today’s Bitcoin news, BTCPay Server, the free open-source payment processor operated directly by numerous Bitcoin merchants, instructed all operators to deactivate their instances following reports that malicious actors were draining hot wallets on merchant servers. Less than six hours later, outdated software was identified as the culprit.
At 04:07 UTC on Monday, the project reported that its investigation uncovered an attack vector targeting servers operating version 2.4.1—released on July 23—or earlier iterations. The project noted there are “no credible reports” of fund drains affecting the current version 2.4.7. BTCPay has not disclosed the total amount stolen or the exact number of stores impacted.
This incident differs fundamentally from last week’s Binance hack, as no cryptocurrency exchange was compromised. Instead, the targets were merchants who manage their own payment infrastructure—the exact demographic self-custody is designed to protect.
Consequently, questions remain regarding who was exposed and what store owners should do next.
🚨 Security Alert!
Unauthorized attackers are reportedly draining hot wallets on @BtcpayServer instances.
Users running BTCPay Server instances are advised to shut them down immediately. pic.twitter.com/H7mXfJLLcD
— Lookonchain (@lookonchain) November 2, 2026
Market Intelligence: Crypto Security Analyst Recommends Best Anonymous Crypto Wallets
What Happened to the BTCPay Server Hot Wallets?
An attacker gained administrative access to older servers and emptied the hot wallets. BTCPay Server issued its initial warning at 22:25 UTC on Sunday, requesting that operators execute its shutdown script “until we complete the investigation.”
Two hours afterward, founder Nicolas Dorier stated that the project’s public servers running version 2.4.7 had avoided attack. “The attacker managed to log in as admin on those instance, we are still trying to figure out how,” he noted.
An updated statement followed at 04:07 UTC:
📢 Our incident response investigation identified an attack vector targeting instances running versions 2.4.1 (Jul 23, 2026) or older.
We have no credible reports of hot wallet drains for users running the latest 2.4.7 release. We again urge everyone to keep their BTCPay Server… pic.twitter.com/gYxK4Bb7fc
— BTCPay Server (@BtcpayServer) November 2, 2026
A hot wallet stores its signing keys directly on the server to facilitate automated refunds and payouts. Anyone possessing administrative privileges on that server can consequently transfer the funds.
Hosting providers acted swiftly. BTCPay expressed gratitude to LunaNode and other hosts for independently shutting down older hosted instances, meaning some merchants may find their stores offline on Monday.
The version history outlines the timeline. Version 2.4.1 launched on July 23. Two weeks later, version 2.4.2 patched a critical vulnerability described by the team as “being actively exploited,” followed by five additional updates concluding with Thursday’s release of version 2.4.7, which resolved 85 findings uncovered during an AI security scan conducted by Anthropic for the project.
It remains unconfirmed whether this security hole is identical to the one seen in August. Dorier indicated that a blog post containing further details will be published soon.
Is Your BTCPay Server Store Exposed?
Based on current findings from the project, exposure is limited to stores still running version 2.4.1 or earlier. “For those who already updated at least once since the release of 2.4.2, there is no reason to panic,” Dorier stated at 04:10 UTC.
Recommended actions for operators include:
- Check the version. Any instance running version 2.4.1 or lower must remain offline until updated.
- Update to 2.4.7. Administrators can select Update via Server Settings → Maintenance. Docker installations should execute the
btcpay-update.shscript over SSH, while Umbrel or Start9 users can install the update directly through their respective platforms, as detailed in BTCPay’s documentation. - Keep the hot wallet thin. In Dorier’s own words: “don’t keep too much in your Hot Wallet.” Sales revenue should be swept to cold storage, leaving only the minimum necessary balance for refunds.
- Report a drain. Affected victims are instructed to forward details and log files to security@btcpayserver.org.
The reported thefts exclusively impacted hot wallets. Retailers configuring incoming payments to watch-only wallets keep their signing keys entirely isolated from the server.
DISCOVER: Binance Hacker Sits on $1.4 Billion in Bitcoin, Triple a Week of ETF Buying
Did This Bitcoin News Move the BTC Price?
No. BTC was priced at $77,890 when the alert was published and traded at $78,102 on Binance at 07:40 UTC on Monday, marking a 0.3% daily increase. The market continues to digest the impact of last week’s Binance breach.
That exploit established a price floor. Bitcoin dipped to $76,326 on October 30, touching the 200-day exponential moving average (EMA)—currently sitting at $76,512—where buyers have successfully defended the level for three consecutive days. Overhead resistance is marked by the 50-day EMA at $80,293, while the range is capped by the October 29 pre-hack high of $81,971.
The Crypto Fear & Greed Index registers 37 (Fear), with BTC reflecting a 2.5% loss over the week.
August 5 to November 2, 2026: BTCUSDT 1D chart. Source: TradingView
| Outlook | Trigger | Level to watch |
|---|---|---|
| Rebound | A daily close above $80,293 | $81,971, the October 29 high |
| Holding pattern | Holding between $76,326 and $80,293 | A range between the two EMAs |
| Sell-off | A daily close below $76,326 | $74,968, the September 15 low |
Market Intelligence: Crypto Analyst Predicts Best Low-Cap Crypto
next
