BTCPay Server Reports No Wallet Drains on Latest Release After Asking Merchants to Go Offline

Dextape brief

By Dextape Desk · November 2, 2026

BTCPay Server urged merchants using its open-source payment tool to go offline on Sunday, after reports that unauthorized parties were emptying hot wallets on some installations. It also asked operators to run a shutdown script during the investigation. Founder Nicolas Dorier said the intruder seemed to have logged in as admin on versions before 2.4.2, while the project's public servers on 2.4.7 were not attacked. Late Sunday the project said it had identified an attack vector affecting version 2.4.1 and older, and reported no credible drain reports for 2.4.7 users. It invited users hit by the problem to forward specifics and logs to its security staff. The posts gave no loss figures, server counts or attack details, and no formal advisory had appeared by Monday morning.

Why it matters: The reported entry point differs from August's incident, showing that hot wallets on self-hosted BTCPay instances can be drained through a separate route.

Summary by Dextape, based on reporting by Unchained. Written with AI from the publisher’s text and checked automatically for copied wording and unsupported figures. Not investment advice.