BTCPay Advises Shutting Down Servers Amid Reports of Hot Wallet Fund Withdrawals
Key Facts
BTCPay Server advised operators to temporarily shut down their instances as it continues investigating reports of unauthorized withdrawals from hot wallets. The project said, according to TokenPost on November 1, 2026, that operators should stop services using the command "./btcpay-down.sh" until the investigation is complete. The recommendation raises the prospect of merchants who run the system themselves being unable to accept Bitcoin payments. The team has not disclosed the total losses or the number of affected servers. It has also not yet determined how the attackers gained access to the instances.
Project founder Nicolas Dorier said the reports appear linked to BTCPay Server versions earlier than 2.4.2, but did not present that as a confirmed scope for the incident. He added that the attacker accessed the affected instances as an administrator, while the team had not identified how that access was obtained. Dorier said the project’s public servers, which run version 2.4.7, were not attacked. That does not establish whether the newer version would prevent the incident in other deployments. The investigation is ongoing, and no figures are available for the number of affected parties or the value of the funds withdrawn.
The new reports differ from a previous security vulnerability fixed in version 2.4.2, which involved LND node credentials. In its alert published on August 7, 2026, BTCPay said the vulnerability was critical and affected earlier versions, and could allow an unauthenticated remote attacker to access credential files. Those files could enable control of an LND node and movement of funds. But the project said the risk applied to deployments using LND, and that BTCPay’s on-chain wallets, including hot wallets, were not affected by that vulnerability. The earlier alert therefore does not establish that the current incident stems from the same vulnerability.
In the August incident linked to the LND vulnerability, IVPN said an attacker extracted its node credentials and transferred operating funds in two transactions totaling 0.6168 Bitcoin. The company said the attacker did not access the core server and that the breach was limited to the payment application; it also said the attack was not specifically targeted at the company. Lightning payments on IVPN’s website were disrupted from August 7 to 10, while the other payment methods cited by the company, including on-chain Bitcoin, Monero, cards and PayPal, continued to operate. IVPN said it saw the vulnerability disclosure on the evening of August 7, then immediately shut down and updated its payment system. That incident provides earlier security context, but does not establish the scale of losses or damage in the new reports.
Version 2.4.7 was released on October 29, and its release notes said it addressed 85 security findings detected by scanning, with a specific recommendation to update for servers shared by multiple merchants. Dorier said the project’s public servers on that version were not attacked, while the team has not announced that the update provides a fix for the new incident. In its earlier August alert, BTCPay advised LND users who could not update immediately to keep the server offline until they could do so. It also said version 2.4.2 automatically regenerates macaroon credentials during an update and upgrades LND to version 0.21.1. The project urged LND users to review payments, channel closures and balances for unknown activity.
Following the earlier incident, BTCPay said it would prepare a full report and publish it when ready. In the current reports, the project advised shutting down instances until the investigation is complete and has not yet disclosed the access method, the number of affected servers or the value of the losses. The link to versions earlier than 2.4.2 remains Dorier’s assessment, not a final finding announced by the team. The project has also not set a date for publishing the results of the new investigation. Any update on the incident’s scope or remediation depends on what the team announces after the investigation concludes.