BTCPay Server says its incident response investigation found an attack vector aimed at servers running version 2.4.1 or older.[1] The project says it has no credible reports of hot-wallet drains on the latest 2.4.7 release.[1]
Reporting cutoff: November 2, 2026, 2:21 a.m. EST / 07:21 UTC.[6] This is a fast-moving incident; the status below reflects sources available at that time.[6]
What BTCPay Server has confirmed
BTCPay Server first said it was receiving reports that unauthorized attackers were sweeping hot wallets and asked operators to shut down their instances while it investigated.[2]
Its next public update narrowed the identified attack vector to versions 2.4.1 or older and said there were no credible drain reports for users on 2.4.7.[1]
Who should act now
Version 2.4.1 or older
Keep the instance shut down while you preserve evidence and plan a controlled recovery.[2][5] The version condition comes directly from the project’s incident update.[1]
Versions 2.4.2 through 2.4.6
The incident update does not place these releases inside the identified 2.4.1-or-older range, but it also does not give them the separate “no credible reports” statement made for 2.4.7.[1] Verify the exact version, preserve evidence, and move through a controlled update to the latest supported release.[1][3][5]
Version 2.4.7
The project reports no credible hot-wallet-drain reports on 2.4.7 at the cutoff, but that is not a guarantee that every server is uncompromised.[1]
Unknown version
Treat the version as unknown until it is verified; do not infer safety from the server still being online or accepting payments.[1][2] Preserve evidence and follow the project’s shutdown request while you establish the version.[2][5]
A practical response sequence
- Containment and evidence.[2][5] BTCPay asked operators to shut down affected instances and named
./btcpay-down.sh.[2] Powering down can change or destroy volatile evidence, so if a qualified responder can safely capture short-retention evidence without delaying necessary containment, do that first; otherwise prioritize stopping further loss.[2][5] - Evidence collection.[5] Keep relevant logs before upgrades or resets.[5] CISA guidance says to collect relevant logs and preserve volatile or short-retention evidence.[5]
- Activity review.[5][7] With qualified assistance, review wallet transactions and administrator access.[5][7] This is practical incident-response guidance, not a claim that every older server was breached.[1]
- Release update.[3] BTCPay’s 2.4.7 release was published October 29 and its release notes highly recommend updating, especially on servers shared by multiple merchants.[3]
- Compromise recovery.[5][7] If you find unauthorized transfers, unknown administrator access, or other compromise indicators, involve a qualified incident responder and consider a clean rebuild.[5][7] CISA advises rebuilding affected systems from clean images and addressing affected credentials after the environment is cleaned.[5]
What remains unknown
- BTCPay had not published a complete technical root-cause explanation in the reviewed incident updates at the cutoff.[1][2]
- CoinDesk reported that BTCPay had not specified a loss amount or a count of affected servers.[7]
- “No credible reports” on 2.4.7 is a point-in-time incident statement, not proof that every installation is safe.[1]
Why this matters to small businesses
A hot wallet can authorize outgoing payments because signing material is available to the online system.[7]
The immediate decision is whether your server is in the identified version range, whether a hot wallet is present, and whether your logs or wallet history show unauthorized activity.[1][5][7] Those checks are practical triage, not proof that every older installation was compromised.[1]
Bottom line
If you operate BTCPay Server 2.4.1 or older, leave it shut down, preserve evidence, and move through a controlled recovery to the latest supported release.[1][2][3][5] If you are already on 2.4.7, treat the absence of current credible reports as a point-in-time statement—not a blanket assurance.[1]
Sources
- BTCPay Server incident update: versions 2.4.1 or older (November 2, 2026; accessed at cutoff).
- BTCPay Server initial hot-wallet alert (November 1, 2026; accessed at cutoff).
- BTCPay Server 2.4.7 release notes (October 29, 2026).
- BTCPay Server: Security Advisory — Update to 2.4.2 Immediately (August 2026; background).
- CISA incident-response guidance on preserving evidence and rebuilding (stable guidance; accessed at cutoff).
- The IT Guys reporting-cutoff observation, recorded November 2, 2026.
- CoinDesk: BTCPay tells users to switch off servers after drained-wallet reports (published November 1, 2026; updated November 1, 2026).