Hacks & scams / Hack
Developing story. Our agents re-check this case every few hours; the latest update is at the top of "Updates".
50severity
HackactiveBitcoin
BTCPay Server hot wallet drains: BTCPay Server tells operators to shut down after reports of hot wallets being swept; losses unconfirmed
2026-11-01 · updated 2026-11-02 05:53 UTC · by Sentinel, VaultX incident desk
Reported lossundisclosedNo confirmed or reported total in USD or BTC; the sources reviewed say the total stolen has not been disclosed
Attributionunknown. No attribution has been published; reports say the cause, entry point and scale remain unknown.
Response score60/100The project issued a fast, clear shutdown warning and later reporting named affected versions, but it gave no root cause or loss figures and no compensation was reported.
Severity50/100Multiple self-hosted installations were reportedly drained, but no confirmed loss total or user count exists and there is no sign of systemic market impact.
On Nov. 1, 2026 BTCPay Server warned operators to shut down their instances after reports that hot wallets on multiple installations were being swept by unauthorized attackers. The project's alert gave no root cause. Later reporting pointed to older versions (reported as predating 2.4.2, or 2.4.1 and older), with no credible reports affecting the latest 2.4.7 release. As of Nov. 2, the number of affected servers, the total stolen and the intrusion method were all unconfirmed.
Get instant hack alerts
We message you the minute a major hack, exploit or fraud is confirmed, with the amount lost and what to do. Free, no spam, stop any time.
Updates
2026-11-02 05:53 UTCPer Odaily and TokenPost, BTCPay's incident-response update says it identified an attack vector targeting instances on version 2.4.1 (released July 23, 2026) or older, and that it has no credible reports of hot wallet drains on 2.4.7. Founder Nicolas Dorier reportedly said the attackers obtained administrator access, though how they got it is still undetermined. Affected admins are asked to email details and logs to security@btcpayserver.org. The total stolen and victim count remain undisclosed as of Nov. 2, 2026.
What happened
According to BTCPay Server's own notice, posted on X on Nov. 1, 2026, the project received reports that hot wallets on multiple BTCPay Server installations were being swept by unauthorized attackers. It told operators to run ./btcpay-down.sh and keep systems offline until the investigation finished.
Media coverage continued through Nov. 2, 2026 (CoinDesk, Bitcoin.com and others). The affected asset is consistently identified as bitcoin held in Bitcoin hot wallets, meaning wallets directly connected to the server.
The initial alert did not disclose a technical root cause. Later reporting (Cybersecurity News and Coinfomania, per the research) attributed the issue to older versions: one account says versions predating 2.4.2, another says 2.4.1 or older. These reports also say there were no credible reports of drains on the latest 2.4.7 release. One report said affected servers appeared to have had administrator-level access compromised. The official alert did not confirm that detail.
Separately, a BTCPay Server security post dated Oct. 8 describes a previously disclosed vulnerability that let an attacker obtain LND admin macaroon credentials and access connected LND wallets. The post asks affected users to report on-chain addresses and transaction details. The research does not state whether that incident is linked to the Nov. 1 drains, so the two should not be assumed to be the same event.
How it worked
The exact attack method for the Nov. 1 drains has not been confirmed. Reporting points to older, unpatched BTCPay Server versions and, in one unconfirmed report, compromised administrator-level access. Because the funds sat in hot wallets connected to the servers, an attacker with sufficient access could move them out without any further approval. One crypto news item in the research also mentions bots probing exposed payment servers to steal administrative keys. That item is only a headline in the source list, and it is not confirmed as related to this incident.
The Oct. 8 post describes a different, earlier vulnerability that exposed LND admin macaroon credentials. A macaroon is an authentication token for an LND node, and the admin one grants broad control over the node's wallet. Any link to the Nov. 1 events is unconfirmed.
Timeline
- 2026-10-08BTCPay Server security post describes an earlier vulnerability that exposed LND admin macaroon credentials and asks affected users to report addresses and transactions (reported as a separate incident; year per context).
- 2026-11-01BTCPay Server posts a notice on X: reports of hot wallets swept by unauthorized attackers; operators told to run ./btcpay-down.sh and stay offline.
- 2026-11-01Reporting names older versions as affected (reported as before 2.4.2 / 2.4.1 or older) and says no credible drain reports on 2.4.7.
- 2026-11-02CoinDesk, Bitcoin.com and others report the shutdown warning; no confirmed loss total, attacker identity or number of affected servers is disclosed.
Where the money went
Unknown. No attacker wallet addresses have been published. No confirmed tracing to mixers, bridges or exchanges was found, and no freezes or recoveries were reported for the Nov. 1-2 incident.
The response
On Nov. 1 BTCPay Server told operators to shut down immediately and stay offline while it investigated. It has not publicly disclosed the root cause, total losses or a full list of affected servers. No compensation, reimbursement or insurance fund was reported. No regulator or police action was reported. The reports do not describe a formal platform-wide withdrawal pause. BTCPay Server is self-hosted software, so each operator controls their own server.
Market and user impact
The number of affected servers and total losses are unconfirmed. Operators of self-hosted BTCPay instances, such as merchants accepting bitcoin, were told to take servers offline, which interrupts their payment acceptance. The available reports include no verified Bitcoin price reaction. No solid sample of user reactions was available beyond expressions of concern and caution.
What people say
55% negative · 5% positive · the rest neutral · themes: urgent shutdown advice, uncertainty over root cause and scale, outdated software risk, self-hosting security responsibility
How to protect yourself
- If you run BTCPay Server, follow the project's guidance: shut the instance down with ./btcpay-down.sh and wait for official instructions before restarting.
- Update promptly. Reporting ties the drains to older versions (before 2.4.2) and says no credible drains were reported on 2.4.7, but this is not yet confirmed by an official root-cause analysis.
- Keep only the funds needed for short-term operations in server-connected hot wallets, and sweep the rest to cold storage or hardware-signed wallets.
- Treat admin credentials and LND macaroons as secrets. Rotate them if you suspect exposure, and restrict network access to admin interfaces.
- If you were affected, report on-chain addresses and transaction details to BTCPay Server, as its Oct. 8 post requested for the earlier incident, to help with tracing and contact with exchanges.
- Builders should publish root cause, affected versions and indicators of compromise quickly, so operators can judge their own exposure.
Check a walletScan a tokenStill unknown
- The exact intrusion method and root cause
- Which versions are affected (reports vary between before 2.4.2 and 2.4.1 or older) and whether 2.4.7 is safe
- The number of affected servers and total BTC or USD stolen
- Who is behind the attack and which wallet addresses were used
- Whether the Nov. 1 drains are connected to the Oct. 8 LND macaroon vulnerability
- Whether administrator-level access was compromised, as one report claims
- Whether any funds have been frozen or recovered, and whether operators will be compensated
Related on VaultX
Atomic Wallet hack: Atomic Wallet users lost an estimated $100M+ in June 2023; Elliptic…Hack report · In early June 2023, users of the Atomic Wallet software wallet reported unauthorized drains of…Bybit Ethereum cold wallet hack: Bybit loses about $1.46B in ETH from a cold wallet; FBI…Hack report · On Feb. 21, 2025, Bybit said one of its Ethereum cold wallets was compromised in a 'sophisticated…Polymarket (international platform) third-party script exploit: Polymarket halts…Hack report · On 2026-10-29 Polymarket paused trading on its international platform after users reported drained…Bitcoin Hyper review: High riskReview · Anonymous presale with regulator warning, user reports of vanishing funds, no working mainnetBitcoin review: MixedReview · 18-year-old open-source network with no issuer; US regulators call it highly speculativePepe review: MixedReview · Meme coin with no roadmap, anonymous team, and a $16M multisig withdrawal that sparked rug-pull…Bitcoin Slides Below $77,000 as Tech Sell-Off Spreads to CryptoNews · Bitcoin fell toward $77,000 on Oct. 30 as a tech-led sell-off hit stocks and crypto, with reports…Bitcoin Heads for Worst October in 12 Years as Tech Sell-Off SpreadsNews · Bitcoin was reported near $77,000 and on track for its weakest October since 2014 as a tech…Binance hit by reported $6.3B multi-chain theft; TraderTraitor link flaggedNews · Reports put Binance's multi-chain theft at about $6.3B, with ~$3B frozen. TRM Labs links it to…Hot and cold walletsGlossary · A hot wallet is connected to the internet (an app or browser extension); a cold wallet keeps keys…Seed phraseGlossary · A seed phrase is the 12 or 24 words that can restore a crypto wallet. Whoever has it controls the…Bitcoin dominanceGlossary · Bitcoin dominance is Bitcoin's share of the total crypto market value, shown as a percentage.
Sources
- BTCPay Server X alert
- r0ckstardev on X, shutdown instruction and version note
- CoinDesk: BTCPay tells users to switch off servers
- Bitcoin.com: BTCPay hit by hot wallet theft reports
- investingLive
- Cybersecurity News
- Coinfomania
- PANews
- RuntimeWire
- BTCPay Server incident post (Oct. 8, separate LND macaroon vulnerability)
How we report: Sentinel reads news, investigators' posts, company statements and on-chain data, attributes every claim to its source and marks unconfirmed numbers as reported. Severity measures size and systemic risk; the response score measures how fast and transparently users were protected. Not financial advice and not a finding of guilt. Corrections: contact us.
Get new hack reports as they happen
New exploit reports, major incidents and security updates from VaultX. Free. You choose below; nothing starts until you opt in.
On Telegram, press Start in the bot to subscribe. New reports are also posted on our alerts channel. Not financial advice. 
VaultX