BTCPay Server: Attackers Logged In as Admin and Swept Merchants' Bitcoin

At 22:25 UTC on Sunday 1 November 2026, the team behind BTCPay Server posted the message no payments business wants to send: "We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers." The advice to every shop running the software was blunt. Shut the server down until the investigation is finished.

By then most of the money had already gone. Nicolas Dorier, the French developer who founded BTCPay Server, later published the bitcoin and litecoin addresses where the attacker was collecting the coins. A CMZ count of those two addresses at 08:45 UTC on 2 November found about 18.74 bitcoin and 3,410 litecoin sent in from other wallets, worth about $1.65M at that morning's prices. That is CMZ's own count, not an official loss. BTCPay has published no loss figure and no count of the shops hit, and coins were still arriving while the count was made.

The team's working answer came early on 2 November. The servers that were raided ran version 2.4.1 or older, software released on 23 July and replaced by a security fix on 7 August. The attacker, Dorier wrote, "managed to log in as admin".

A card terminal the shop runs itself

BTCPay Server is free software that lets a shop take bitcoin payments straight into its own wallet. No payment company sits in the middle, takes a fee or holds the money. The nearest comparison is a shop that owns and runs its own card terminal and its own vault instead of using Visa and a bank. Dorier released the first version in 2017 as a rival to BitPay, the payment company most shops used at the time. The code is open for anyone to read and copy. Namecheap, the web domain seller, the travel site CheapAir, the newspaper Hong Kong Free Press and the Human Rights Foundation have all used it.

"Self-hosted" is the catch. Each shop runs its own copy, on its own rented computer or through a hosting company such as LunaNode. When the BTCPay team fixes a flaw, nothing changes on a shop's server until its owner installs the update. There is no central switch. CoinDesk, a crypto news site, noted that the team could only ask owners to turn their own machines off.

The money sat in a hot wallet. To send refunds or move takings without a person approving each payment, a shop can let BTCPay keep the wallet's master key on the server itself. That is the till: open, on the counter, ready to pay out. BTCPay's own guide marks the option with a danger warning, CoinDesk reported. The other set-up is "watch-only": the server sees payments arrive, but the key that can spend them sits on a separate device, like a safe in the back office. Someone who controls the server as administrator can empty a hot wallet. A watch-only wallet gives them nothing to spend, TFTC, a bitcoin news site, reported.

One night, hour by hour

All times are UTC. The first coins reached the attacker's bitcoin address at 13:35 on 30 October, the blockchain record shows. BTCPay has not said when the attack began. The heaviest hours came on the afternoon of 1 November, between 14:00 and 22:00, before any public warning.

At 22:25 BTCPay posted its alert. Three minutes later a core developer who posts as Uncle Rockstar Developer added: "Not a drill: shut down your BTCPay Server if you have a hot wallet." At 22:31 CoinCards, a gift card shop that takes bitcoin, said it had taken its BTCPay server down "out of an abundance of caution". It did not report a loss.

At 00:28 on 2 November Dorier said BTCPay's own public servers, which ran the newest version, 2.4.7, had not been attacked, and that the reports came from servers older than 2.4.2. "The attacker managed to log in as admin on those instance, we are still trying to figure out how." At 01:52 he added: "We have traces that pre 2.4.2 vulnerabilities were used."

At 04:07 BTCPay posted its update. It had "identified an attack vector targeting instances running versions 2.4.1 (Jul 23, 2026) or older" and had "no credible reports of hot wallet drains" on 2.4.7. Victims were asked to send details and logs to its security address. Some hosting companies had already shut down older servers on their own, and BTCPay thanked LunaNode by name. Dorier said anyone who had updated at least once since 2.4.2 had "no reason to panic", and added: "don't keep too much in your Hot Wallet." He published the bitcoin address at 04:13 and the litecoin address at 04:44. At 05:46 Andrew Camilleri, a BTCPay maintainer, warned that updating afterwards was not enough: "Treat the entire machine as compromised."

What the two addresses show

CMZ counted only money that came in from other wallets. Coins the attacker sent back to the same address, the way a cash payment returns change, were left out. On that basis the bitcoin address had received about 18.74 BTC in 589 transfers, drawn from more than 10,000 different addresses, by 08:45 UTC on 2 November. Most transfers were small, a fraction of a single bitcoin each, which fits tills that collect many small payments. The largest was about 1.86 BTC. About 16.73 BTC, or about 89 percent, arrived before BTCPay's 22:25 alert. About 17.9 BTC has since been moved on to other addresses that CMZ has not traced. At today's prices the bitcoin is worth about $1.47M.

The litecoin address had received 3,410 LTC, about $188,000, starting at 13:17 on 1 November, and had sent nothing out. Litecoin is a separate, older cryptocurrency that BTCPay can accept through an add-on, so the attacker emptied whatever the hot wallets held, not only bitcoin.

The count has limits. It rests on Dorier's word that these are the attacker's addresses. One shop can be swept more than once, so the number of transfers is not the number of victims. And CMZ cannot prove that every coin that arrived came from a victim.

Three months of warnings

This was BTCPay's second emergency in three months. On 7 August the team released 2.4.2 to fix a flaw that was "actively exploited". Outsiders could take the passwords that control a shop's Lightning node, the part of BTCPay that handles a faster payment network built on top of bitcoin, and drain it. Foundation, a maker of bitcoin hardware wallets, said its Lightning node was swept. BTCPay offered a reward of 10 percent of anything recovered, up to 3 BTC, and said at the time that on-chain hot wallets were not affected. The same release fixed other flaws and switched off an older sign-in method by default.

BTCPay has not said which of the flaws fixed before 2.4.2 was used this time. Cointelegraph and CoinDesk both reported that it is unclear whether the new attacks are linked to August. Two more security releases followed in late October: 2.4.6 on 26 October and 2.4.7 on 29 October, an emergency update with 85 fixes found by an AI scanning program from Anthropic. The team said it saw "no evidence of exploits" of those flaws.

The servers that were emptied had missed all of it: nearly three months of updates, including an emergency fix for a flaw that was being used to steal money when it was released. The software was free. Keeping it current was each shop's own job.