BTCPay Server urged merchants on November 1, 2026 to shut down their payment servers following reports of unauthorized attackers gaining administrative access and sweeping hot wallets. Founder Nicolas Dorier identified the attack vector as targeting self-hosted instances running software versions older than 2.4.2. Because BTCPay Server operates without a centralized custodian, operators must manually execute shutdown commands and update to version 2.4.7.
Hot wallet security risks
- ▪BTCPay Server documentation flags the platform's automatic seed signing feature with a DANGER label due to the security risk of unauthorized server intruders sending funds directly to their own addresses
- ▪BTCPay Server hot wallets automatically store seed phrases on internet-connected merchant servers to automatically sign and approve payments without separate device confirmation
Decentralized server architecture vulnerabilities
- ▪BTCPay Server has no centralized master switch to disable vulnerable software, requiring the project to publicly instruct individual server owners to execute the ./btcpay-down.sh command
- ▪BTCPay Server relies on a decentralized architecture where each business owner hosts its software on a private server and bears independent responsibility for securing their own infrastructure
Attack vector in older versions
- ▪BTCPay Server reported that attackers logged in as administrators on compromised servers, while users running version 2.4.7 received no credible reports of hot wallet drains
- ▪BTCPay Server founder Nicolas Dorier stated that reports of hot wallets being drained on its servers involved software releases older than version 2.4.2, specifically targeting instances running version 2.4.1 or earlier released July 23, 2026
BTCPay Server shutdown response
- ▪BTCPay Server urged operators running older software releases to update their installations to version 2.4.7
- ▪BTCPay Server instructed server operators to keep software turned off via the ./btcpay-down.sh command while asking affected users to submit server information and logs to its security team
August vulnerability security history
- ▪In August 2026, BTCPay Server confirmed an attack that exploited a software vulnerability in releases prior to version 2.4.2 to obtain Lightning Network Daemon credentials and steal funds
- ▪BTCPay Server patched the August 2026 Lightning Network Daemon credential vulnerability in version 2.4.2 and restricted remote Lightning access following the August 2026 exploit
Story comments
Loading comments…