EL7.AI
CryptoMediumUpdated×2•Originally published 1 November 2026•Updated 2 November 2026•
4 min read

BTCPay Urges Server Shutdown After Reports of Funds Transferred From Hot Wallets

Key Facts

1On 2 November, BTCPay received reports that unauthorized attackers had transferred funds from hot wallets and urged operators of its instances to shut down their servers until the investigation ends.
2The published report did not disclose the cause of the incident or the scale of losses.
3Version 2.4.2 fixed the August vulnerability, which affected earlier versions and targeted LND credentials.
4The 2.4.7 release log noted fixes for 85 security findings: 1 critical, 13 high, 52 medium and 19 low.

BTCPay Server urged operators of its instances to shut down their servers until the investigation is complete, after receiving reports that unauthorized attackers transferred funds from hot wallets, according to a report published by ChainCatcher on 2 November 2026. The report said the project advised operators to suspend their servers while it examines the incident. Gate News reported that the instructions included running the command ./btcpay-down.sh and keeping servers offline until the investigation ends. The recommendation puts operators of self-hosted payment systems under immediate pressure to take action that could suspend their services while the circumstances surrounding the transfers become clearer. The report had not disclosed the cause of the attack or the scale of losses at the time of publication.

No details were available on the number of wallets affected or the value of the funds transferred, while the motive behind the attack remained undisclosed, according to Gate News. This comes as the project is asking operators to stop their servers until the investigation ends, without the report giving a date for lifting the recommendation. Available information did not establish whether the transfers were linked to a specific technical flaw or to how the servers were configured. The attackers' motives and the financial losses therefore remain undetermined in the published reports. ChainCatcher gave its report's publication time as 06:57:43 on 2 November, while the information provided included no total or estimate of the funds affected.

The new reports differ in their description from the August incident, which prompted a separate security warning from BTCPay. In an alert published on 7 August, the project said a vulnerability allowed a remote attacker to obtain LND credential files without authentication, potentially enabling control of the node and movement of funds. The alert at the time confirmed that the flaw had been exploited and funds had been stolen, and identified version 2.4.2 as the release that fixed it. BTCPay also said all earlier versions were affected and identified LND users as being at risk of credential theft. Published information does not establish that the November reports resulted from or were linked to the August vulnerability.

In its explanation of the August incident, BTCPay said its on-chain wallets, including hot wallets, were not affected by the vulnerability targeting LND credential files, but noted that funds held in an on-chain LND wallet might have remained at risk because it was part of the affected node. The more recent reports concern funds transferred from hot wallets, according to the report; it did not specify whether these were the BTCPay on-chain wallets discussed in the earlier warning or how the transfer occurred. In its coverage of the August incident, The Defiant said Foundation and Citadel21 magazine reported that their Lightning nodes had been drained. Neither disclosed the amount of losses, and no total was published for the number of nodes affected or the amount of bitcoin transferred in that incident. These events remain separate context from the new report, as available information does not establish a link between them.

In the context of security updates, the BTCPay Server 2.4.7 release log noted fixes for 85 security findings reported by Anthropic OSS Scanner. The log classified one finding as critical, 13 as high, 52 as medium and 19 as low, according to the original severity ratings in the report. But the release log does not say whether these findings were related to the transfers covered in the 2 November reports, or indicate that the update addressed their cause. The release therefore provides context on the remediation of security findings without clarifying the nature or scope of the current incident. The published reports have not yet provided a technical explanation for the fund transfers.

The August alert also described a temporary measure in version 2.4.2: removing public access to the LND interface in Docker deployments, which prevented external wallets such as Zeus from connecting through that route. BTCPay said it intended to restore the option when it was safe to do so. Decrypt also reported that the project asked users to replace macaroon credentials, recreate the macaroons.db file and update authentication strings for other Lightning interfaces; these steps were given in the context of the earlier vulnerability. Available information included no similar instructions specific to the new reports, apart from the recommendation to shut down servers until the investigation ends. The project's stated next step remains completion of the investigation, with no set date for its findings or for lifting the recommendation.