The BTCPay Server team said on Nov. 1, 2026, that unauthorized attackers were draining hot wallets on some crypto payment-processing instances. The investigation identified an attack vector affecting version 2.4.1, dated July 23, 2026, and earlier versions, prompting developers to recommend temporarily shutting down servers.

Administrators urged to shut down instances

In a post on X, the team said it was receiving reports of hot wallets on BTCPay Server instances being swept by unauthorized attackers. It asked anyone running an instance to shut it down with the ./btcpay-down.sh command until the investigation is complete.

The team said there were no confirmed cases of funds being stolen from the hot wallets of users running BTCPay Server version 2.4.7, the latest version identified in its report. Developers emphasized the importance of keeping the software up to date.

Users affected by the attack were asked to send incident details and server logs to [email protected].

Instances operated through hosting providers may have been shut down automatically to prevent exploitation of the vulnerability in outdated versions. The BTCPay Server team thanked LunaNode and other hosting providers for responding quickly after the first report of the incident.

Other reported security incidents

The incident followed a series of hacking attacks against the crypto industry in late October 2026. Binance suffered what the source described as the largest hack in crypto-market history, with estimated losses of $6.3 billion.

Separately, the Trezor security team received a report about a possible hardware implant in a Trezor Safe 5 crypto wallet.

Source: Incrypted