BTCPay Server has issued an urgent security alert after reports that attackers gained unauthorized administrator access to older installations and swept funds from connected Bitcoin hot wallets. What happened - On Nov. 2 the open‑source payment processor told operators to immediately shut down instances using ./btcpay-down.sh while its incident response team investigated reports of hot‑wallet “sweeps” — transfers that move all available funds out of addresses to an attacker-controlled destination. - The team initially warned all users, then narrowed the suspected attack vector to instances running version 2.4.1 (released July 23, 2026) or earlier. Co‑founder Nicolas Dorier said affected installs appeared to be running releases prior to 2.4.2. - BTCPay Server has not disclosed totals or how many servers were compromised. It has, however, said there are no credible reports of wallet drains involving the current 2.4.7 release and that the project’s public servers (running 2.4.7) were not attacked. What is known about the intrusion - Available information indicates attackers were able to log in with administrator privileges on affected instances. BTCPay’s team is still investigating how admin access was obtained and has not publicly detailed the technical exploit. - The breach specifically targeted hot wallets — wallets that are online and able to initiate transactions — leaving them vulnerable to immediate theft if credentials or control are compromised. Actions BTCPay Server is asking users to take - If you run an instance: shut it down immediately with ./btcpay-down.sh until the investigation completes. - If you run an older version: upgrade to the latest release (2.4.7) where possible. - If you believe your server was compromised: preserve logs and send incident details and system logs to security@btcpayserver.org. Context and related incidents - This follows an August incident in which BTCPay warned of an actively exploited vulnerability that allowed attackers to extract LND administrator macaroon credentials and access Lightning wallets. That flaw did not affect standard on‑chain wallets. After the August issue, the project offered a recovery bounty equal to 10% of recovered funds (capped at 3 BTC) and awarded 0.21 BTC each to two reporters who disclosed the vulnerability. - The warning also arrives amid other recent attacks on Bitcoin infrastructure: in September Core Lightning warned of attempts to exploit older, unpatched Lightning nodes. Operational impact - Some hosting providers — including LunaNode and others thanked by BTCPay — have proactively shut down older instances after the alert. If your instance was hosted, it may already be offline until your provider restores service or you update and relaunch. - BTCPay has not published a list of affected hosts, a count of offline servers, or a timeline for the investigation or any recovery of stolen funds. Safety recommendations for operators - Keep BTCPay Server up to date; upgrade to 2.4.7 where possible. - Minimize balances in hot wallets and move excess funds to cold storage (offline keys). - Preserve forensic logs if you suspect compromise and report them to security@btcpayserver.org. - Consider provider and operational controls that reduce risk of unauthorized admin access (strong access controls, monitoring, minimal exposure). BTCPay’s investigation is ongoing. The project is urging caution and swift action from operators while it works to determine exactly how attackers gained administrator access to older installs. We’ll update as BTCPay releases further technical details or recovery information. Read more AI-generated news on: https://app.chaingpt.org/news