BTCPay Server has linked reports of drained Bitcoin hot wallets to an attack vector targeting version 2.4.1 and earlier. In a November 2 update, the project said it had received no credible reports of drains affecting the latest 2.4.7 release and urged operators to keep their software updated.
We have no credible reports of hot wallet drains for users running the latest 2.4.7 release.
— BTCPay Server (@BtcpayServer) November 2, 2026
The findings follow a November 1 shutdown alert after unauthorized attackers swept funds from hot wallets on BTCPay instances. The initial warning asked anyone running an instance to shut it down using ./btcpay-down.sh until the investigation was completed.
The team also said hosting providers, including LunaNode, had taken precautionary action, meaning some older installations may have been shut down automatically. Affected operators were asked to send incident details and logs to the project’s security team. The updates did not disclose aggregate losses or an affected-server count.
BTCPay is self-hosted Bitcoin payment software. Its wallet documentation explains that enabling a hot wallet stores the signing seed on the server, unlike workflows that use an external signing device. That distinction underlies the custody risks CoinScreamer has previously examined.
Version 2.4.7 was released on October 29 with security and reliability fixes, before the latest drain reports. BTCPay’s new statement narrows the identified attack vector to older installations; it does not establish that every newer installation is secure or quantify how many users lost funds.
Disclaimer: CoinScreamer is an independent media brand owned and operated by NuvexMedia LLC, publishing news, research, and market insights on digital assets and related technologies. NuvexMedia LLC invests in and collaborates with companies across the digital asset, blockchain, and technology sectors. These relationships do not influence CoinScreamer’s editorial coverage, and the publication maintains full editorial independence to provide accurate, timely, and objective information. © 2025 NuvexMedia LLC. All rights reserved. This content is for informational purposes only and should not be considered legal, tax, investment, financial, or other professional advice.
