Emergency Alert: Btcpay Server Reports Hot Wallets Under Attack

Btcpay Server Emergency Alert

On November 1, 2026, Btcpay Server, an open-source platform that allows merchants to process Bitcoin transactions without intermediaries, warned of an emergency situation involving unauthorized thefts from hot wallets linked to self-hosted payment systems. Nicolas Dorier, the service's founder, highlighted that the compromised versions of the software were those released before 2.4.2, while reassuring that instances operating on version 2.4.7 remained secure against such attacks. This alert surfaced a mere three days after a significant security overhaul had patched 85 vulnerabilities, raising concerns about the potential hazards faced by operators who may defer critical software updates.

Urgent Response and Recommendations

At approximately 22:25 UTC, the Btcpay Server team issued an urgent message via their official account regarding reports of malicious actions draining funds from their hot wallets. Users were promptly advised to shut down their servers using a specific command until a thorough investigation could clarify the situation. A prominent contributor to the project, known as Uncle Rockstar Developer, echoed the urgency of the alert, stating unequivocally that operators must immediately discontinue any hot wallet usage.

Importance of Software Updates

The Btcpay Server system is pivotal for merchants seeking autonomy in their payment processing for Bitcoin, as it allows for self-hosting and management of wallet operations. However, with this independence comes a significant burden of responsibility for ensuring software is up-to-date. As of now, no details concerning the amount of Bitcoin stolen or the number of affected merchants have been disclosed, nor is there a clear understanding of how the attackers gained access to the systems in question.

Further investigation by Dorier pointed out that only installations running outdated software versions were at risk, reigniting concerns about vulnerability management. The investigation did confirm that instances operating the latest version had not fallen victim to any thefts, which suggests that recent updates could have mitigated these risks, although it does not guarantee the safety of every version currently in use.

Previous Vulnerabilities and Current Risks

In August, Btcpay Server had previously noted a critical vulnerability allowing unauthorized access to Lightning Network Daemon (LND) macaroon credentials. This flaw was rectified in version 2.4.2, which led developers to assert that their on-chain wallets were unaffected by the vulnerability. However, it remains unclear whether the current incidents are related to the same security gap, an earlier flaw, or a unique new exploitation.

Adding urgency to the timeline, the 2.4.7 release on October 29 had stemmed from reports generated via Anthropic's open-source security research initiative, addressing major and minor vulnerabilities across the board. This incident emphasizes a crucial point: merely identifying vulnerabilities is not enough if those fixes are not actively implemented across all hosted systems.

Proactive Measures and Industry Implications

In light of the warning, several businesses, including Coincards, took proactive measures to take their Btcpay instances offline, weighing the risk of operational downtime against the safety of their wallets. Dorier also reiterated the importance of maintaining minimal balances in hot wallets, as funds should only reflect amounts operators are willing to potentially lose due to security breaches.

As the developers continue working on a detailed report, no formal estimates regarding the losses incurred or specific patches have been provided. This incident raises a broader question for the industry: as artificial intelligence technology continues to evolve in identifying vulnerabilities, can self-hosted payment infrastructures keep pace with necessary improvements? In a rapidly changing landscape, the Btcpay incident serves as a stark reminder of the importance of proactive security measures in the realm of cryptocurrency transactions.