In today’s Bitcoin news, BTCPay Server, the free open-source payment processor many Bitcoin merchants run themselves, told every operator to shut down their instance after reports that attackers were sweeping the hot wallets on merchant servers. Less than six hours later, the culprit was old software.
At 04:07 UTC on Monday, the project said its investigation had found an attack vector aimed at servers running version 2.4.1, released on July 23, or older. It has “no credible reports” of drains on the current 2.4.7. BTCPay has not said how much was stolen or how many stores were hit.
That makes this a different kind of Bitcoin news from last week’s Binance hack. No exchange was breached. Merchants who run their own payment stack, the people self-custody is meant to protect, were the target.
So who was exposed, and what should store owners do now?
🚨 Security Alert!
Unauthorized attackers are reportedly draining hot wallets on @BtcpayServer instances.
Users running BTCPay Server instances are advised to shut them down immediately. pic.twitter.com/H7mXfJLLcD
— Lookonchain (@lookonchain) November 2, 2026
Market Intelligence: Crypto Security Analyst Recommends Best Anonymous Crypto Wallets
What Happened to the BTCPay Server Hot Wallets?
An attacker logged in as admin on older servers and emptied the hot wallets. BTCPay Server raised the alarm at 22:25 UTC on Sunday and asked operators to run its shutdown script “until we complete the investigation.”
Two hours later, founder Nicolas Dorier said the project’s own public servers on 2.4.7 were not attacked. “The attacker managed to log in as admin on those instance, we are still trying to figure out how,” he wrote.
The update followed at 04:07 UTC:
📢 Our incident response investigation identified an attack vector targeting instances running versions 2.4.1 (Jul 23, 2026) or older.
We have no credible reports of hot wallet drains for users running the latest 2.4.7 release. We again urge everyone to keep their BTCPay Server… pic.twitter.com/gYxK4Bb7fc
— BTCPay Server (@BtcpayServer) November 2, 2026
A hot wallet keeps its signing keys on the server itself, so it can pay out refunds and payouts automatically. Anyone with admin rights on that server can send the coins too.
Hosting providers moved fast. BTCPay thanked LunaNode and others for shutting down older hosted instances on their own, so some merchants may find their store offline on Monday.
The version history is the story. 2.4.1 shipped on July 23. Two weeks later, 2.4.2 fixed a critical flaw the team said was “being actively exploited,” and five more releases followed, ending with Thursday’s 2.4.7, which fixed 85 findings from an AI security scan Anthropic ran for the project.
Whether this is the same hole as August’s is still open. Dorier said a blog post with more detail is coming.
Is Your BTCPay Server Store Exposed?
Only if it still runs 2.4.1 or older, on what the project knows so far. “For those who already updated at least once since the release of 2.4.2, there is no reason to panic,” Dorier wrote at 04:10 UTC.
What operators should do now:
- Check the version. Anything at 2.4.1 or below stays offline until it is updated.
- Update to 2.4.7. Admins can click Update under Server Settings → Maintenance. Docker installs run the
btcpay-update.shscript over SSH, and Umbrel or Start9 users install it from their platform, as BTCPay’s guide sets out. - Keep the hot wallet thin. Dorier’s own advice: “don’t keep too much in your Hot Wallet.” Sweep sales to cold storage and leave only what refunds need.
- Report a drain. Victims are asked to send details and logs to [email protected].
The reported drains all hit hot wallets. Stores that receive into a watch-only wallet keep their signing keys off the server altogether.
DISCOVER: Binance Hacker Sits on $1.4 Billion in Bitcoin, Triple a Week of ETF Buying
Did This Bitcoin News Move the BTC Price?
No. BTC sat at $77,890 when the alert went out and traded at $78,102 on Binance at 07:40 UTC on Monday, up 0.3% in a day. The market is still chewing on last week’s Binance hack.
That hack set the floor. Bitcoin fell to $76,326 on October 30, right on the 200-day EMA (exponential moving average), now at $76,512, and buyers have held above it for three days. Above, the 50-day EMA at $80,293 is now overhead, and $81,971, the October 29 high before the hack, caps the range.
The Fear & Greed Index reads 37, fear, and BTC is down 2.5% on the week.
August 5 to November 2, 2026: BTCUSDT 1D chart. Source: TradingView
| Outlook | Trigger | Level to watch |
|---|---|---|
| Rebound | A daily close above $80,293 | $81,971, the October 29 high |
| Holding pattern | Holding between $76,326 and $80,293 | A range between the two EMAs |
| Sell-off | A daily close below $76,326 | $74,968, the September 15 low |
Market Intelligence: Crypto Analyst Predicts Best Low-Cap Crypto
Disclaimer: Coinspeaker is committed to providing unbiased and transparent reporting. This article aims to deliver accurate and timely information but should not be taken as financial or investment advice. Since market conditions can change rapidly, we encourage you to verify information on your own and consult with a professional before making any decisions based on this content.
Daniel Frances is a technical writer and Web3 educator specializing in macroeconomics and DeFi mechanics. A crypto native since 2017, Daniel leverages his background in on-chain analytics to author evidence-based reports and deep-dive guides. He holds certifications from The Blockchain Council, and is dedicated to providing “information gain” that cuts through market hype to find real-world blockchain utility.
