# BTCPay Server hot wallet drains: BTCPay Server tells operators to shut down after reports of hot wallets being swept; losses unconfirmed
Source page: https://vaultx.llc/hacks/btcpay-server-wallet-drains · VaultX incident report by Sentinel · first published 2026-11-02, updated 2026-11-02
- Date: 2026-11-01
- Attribution: unknown. No attribution has been published; reports say the cause, entry point and scale remain unknown.
- Chains: Bitcoin
- Status: developing
- Severity: 50/100
- Response score: 60/100 (The project issued a fast, clear shutdown warning and later reporting named affected versions, but it gave no root cause or loss figures and no compensation was reported.)
On Nov. 1, 2026 BTCPay Server warned operators to shut down their instances after reports that hot wallets on multiple installations were being swept by unauthorized attackers. The project's alert gave no root cause. Later reporting pointed to older versions (reported as predating 2.4.2, or 2.4.1 and older), with no credible reports affecting the latest 2.4.7 release. As of Nov. 2, the number of affected servers, the total stolen and the intrusion method were all unconfirmed.

**What happened**
According to BTCPay Server's own notice, posted on X on Nov. 1, 2026, the project received reports that hot wallets on multiple BTCPay Server installations were being swept by unauthorized attackers. It told operators to run ./btcpay-down.sh and keep systems offline until the investigation finished.
Media coverage continued through Nov. 2, 2026 (CoinDesk, Bitcoin.com and others). The affected asset is consistently identified as bitcoin held in Bitcoin hot wallets, meaning wallets directly connected to the server.
The initial alert did not disclose a technical root cause. Later reporting (Cybersecurity News and Coinfomania, per the research) attributed the issue to older versions: one account says versions predating 2.4.2, another says 2.4.1 or older. These reports also say there were no credible reports of drains on the latest 2.4.7 release. One report said affected servers appeared to have had administrator-level access compromised. The official alert did not confirm that detail.
Separately, a BTCPay Server security post dated Oct. 8 describes a previously disclosed vulnerability that let an attacker obtain LND admin macaroon credentials and access connected LND wallets. The post asks affected users to report on-chain addresses and transaction details. The research does not state whether that incident is linked to the Nov. 1 drains, so the two should not be assumed to be the same event.

**How it worked**
The exact attack method for the Nov. 1 drains has not been confirmed. Reporting points to older, unpatched BTCPay Server versions and, in one unconfirmed report, compromised administrator-level access. Because the funds sat in hot wallets connected to the servers, an attacker with sufficient access could move them out without any further approval. One crypto news item in the research also mentions bots probing exposed payment servers to steal administrative keys. That item is only a headline in the source list, and it is not confirmed as related to this incident.
The Oct. 8 post describes a different, earlier vulnerability that exposed LND admin macaroon credentials. A macaroon is an authentication token for an LND node, and the admin one grants broad control over the node's wallet. Any link to the Nov. 1 events is unconfirmed.

**Where the money went**
Unknown. No attacker wallet addresses have been published. No confirmed tracing to mixers, bridges or exchanges was found, and no freezes or recoveries were reported for the Nov. 1-2 incident.

**The response**
On Nov. 1 BTCPay Server told operators to shut down immediately and stay offline while it investigated. It has not publicly disclosed the root cause, total losses or a full list of affected servers. No compensation, reimbursement or insurance fund was reported. No regulator or police action was reported. The reports do not describe a formal platform-wide withdrawal pause. BTCPay Server is self-hosted software, so each operator controls their own server.

**Impact**
The number of affected servers and total losses are unconfirmed. Operators of self-hosted BTCPay instances, such as merchants accepting bitcoin, were told to take servers offline, which interrupts their payment acceptance. The available reports include no verified Bitcoin price reaction. No solid sample of user reactions was available beyond expressions of concern and caution.

**Timeline**
- 2026-10-08 BTCPay Server security post describes an earlier vulnerability that exposed LND admin macaroon credentials and asks affected users to report addresses and transactions (reported as a separate incident; year per context).
- 2026-11-01 BTCPay Server posts a notice on X: reports of hot wallets swept by unauthorized attackers; operators told to run ./btcpay-down.sh and stay offline.
- 2026-11-01 Reporting names older versions as affected (reported as before 2.4.2 / 2.4.1 or older) and says no credible drain reports on 2.4.7.
- 2026-11-02 CoinDesk, Bitcoin.com and others report the shutdown warning; no confirmed loss total, attacker identity or number of affected servers is disclosed.

**How to protect yourself**
- If you run BTCPay Server, follow the project's guidance: shut the instance down with ./btcpay-down.sh and wait for official instructions before restarting.
- Update promptly. Reporting ties the drains to older versions (before 2.4.2) and says no credible drains were reported on 2.4.7, but this is not yet confirmed by an official root-cause analysis.
- Keep only the funds needed for short-term operations in server-connected hot wallets, and sweep the rest to cold storage or hardware-signed wallets.
- Treat admin credentials and LND macaroons as secrets. Rotate them if you suspect exposure, and restrict network access to admin interfaces.
- If you were affected, report on-chain addresses and transaction details to BTCPay Server, as its Oct. 8 post requested for the earlier incident, to help with tracing and contact with exchanges.
- Builders should publish root cause, affected versions and indicators of compromise quickly, so operators can judge their own exposure.

**Still unknown**
- The exact intrusion method and root cause
- Which versions are affected (reports vary between before 2.4.2 and 2.4.1 or older) and whether 2.4.7 is safe
- The number of affected servers and total BTC or USD stolen
- Who is behind the attack and which wallet addresses were used
- Whether the Nov. 1 drains are connected to the Oct. 8 LND macaroon vulnerability
- Whether administrator-level access was compromised, as one report claims
- Whether any funds have been frozen or recovered, and whether operators will be compensated

**Sources**
- BTCPay Server X alert https://x.com/BtcpayServer/status/2117020340815819262
- r0ckstardev on X, shutdown instruction and version note https://x.com/r0ckstardev/status/2117020890151956811
- CoinDesk: BTCPay tells users to switch off servers https://www.coindesk.com/tech/2026/11/02/btcpay-a-bitcoin-payment-tool-tells-users-to-switch-off-their-servers-after-reports-of-drained-wallets
- Bitcoin.com: BTCPay hit by hot wallet theft reports https://news.bitcoin.com/security/bitcoin-payment-processor-btcpay-hit-by-hot-wallet-theft-reports/
- investingLive https://investinglive.com/cryptocurrency/btcpay-server-tells-operators-to-shut-down-after-reports-of-hot-wallets-being-drained/
- Cybersecurity News https://cybersecuritynews.com/btcpay-server-warns/amp/
- Coinfomania https://coinfomania.com/btcpayserver-faces-security-breach-as-hot-wallets-compromised/
- PANews https://panews.io/articles/01a19952-381d-76ad-ab1a-74106958c9b2
- RuntimeWire https://runtimewire.com/article/btcpay-server-hot-wallet-drains-shutdown
- BTCPay Server incident post (Oct. 8, separate LND macaroon vulnerability) https://blog.btcpayserver.org/btcpay-server-security-incident-response-and-next-steps/

---
VaultX: free crypto news and intelligence, https://vaultx.llc