Skip to content
BTCPay Server Urges Immediate Shutdown Due to Hot Wallet Attacks

BTCPay Server Urges Immediate Shutdown Due to Hot Wallet Attacks

First seen 2 Nov 2026, 07:18 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 2, 2026 at 08:17 UTC
  • •BTCPay Server warns users to shut down instances due to hot wallet thefts.
  • •The attack targets older software versions, specifically 2.4.1 and earlier.
  • •No thefts reported for users on the latest version, 2.4.7.

BTCPay Server has issued an urgent warning for operators to shut down their instances following reports of unauthorized access draining hot wallets. The attack appears to target older software versions, specifically those running version 2.4.1 or earlier, released on July 23, 2026. No credible reports of theft have been confirmed for users running the latest version, 2.4.7. The organization is investigating the vulnerabilities, which may involve PHP remote-code-execution flaws. BTCPay has not disclosed the number of affected operators or the total value of stolen funds. Users are advised to keep their instances offline until the investigation concludes. This incident follows a previous attack in August that exploited vulnerabilities in the Lightning Network. The situation remains fluid, with further updates expected as the investigation progresses.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-11-02
BTCPay Server issues shutdown warning
BTCPay Server urged operators to shut down instances after reports of hot wallet thefts targeting older software versions.
Cointelegraph
2026-11-02
Investigation launched into vulnerabilities
BTCPay Server is investigating reported vulnerabilities that may have led to unauthorized access and fund drains.
Cryptonews

More articles in this cluster (3)

Extracted Entities (3)

1 / 3

Common questions

Which software versions are affected?
Versions 2.4.1 and earlier of BTCPay Server are affected by the reported vulnerabilities.
What actions should operators take?
Operators are advised to shut down their instances immediately until further notice from BTCPay Server.
Is there any information on the stolen funds?
BTCPay Server has not disclosed the number of affected operators or the total value of stolen funds.