BTCPAY WARNS HOT WALLETS ARE BEING SWEPT ON VERSIONS 2.4.1 AND OLDER — ITS AUGUST ADVISORY FOR THOSE VERSIONS STILL SAYS HOT WALLETS “ARE NOT AFFECTED” — NO LOSS FIGURE, NO POSTMORTEM

At 22:25 UTC on November 1, 2026, BTCPay Server posted: “We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers.” It told everyone running an instance to shut it down. About two hours later, founder Nicolas Dorier wrote: “The attacker managed to log in as admin on those instance, we are still trying to figure out how.” At 04:07 UTC on November 2, the project narrowed it to “an attack vector targeting instances running versions 2.4.1 (Jul 23, 2026) or older.” It gave no loss figure, no count of servers, and no description of the vector.

Now read the last thing BTCPay published about those same versions. Its August 7 advisory, covering every release before 2.4.2, is still on its blog, and it still says: “BTCPay Server’s on-chain wallets, including hot wallets, are not affected.” That line was about a bug that stole LND credentials, and it may still be true of that bug. But it told anyone not using LND they “do not need to update to address this LND credential risk,” while strongly encouraging them to. A merchant with a hot wallet and no Lightning had a reason to wait. BTCPay hasn’t said whether the new attack uses the same flaw or a different one. The line between hit and not hit falls in the same place, 2.4.2, and the 2.4.2 release notes also list a fix for a two-factor bypass.

There are gaps in what has been said. The post reports no credible drains on “the latest 2.4.7 release,” which leaves 2.4.2 through 2.4.6 unmentioned. Version 2.4.7 shipped October 29 with 85 security findings fixed, one critical and 13 high, and the project hasn’t said whether the attacks touch any of them. When we checked at 14:10 UTC on November 2, BTCPay’s blog had no post on the attack, and GitHub showed no published advisory. We flagged the same silence when 2.4.6 shipped on October 26.

This is the part of self-custody nobody can check from the outside. A hot wallet keeps its seed on a server that faces the internet, so an attacker with admin access is one step from signing. BTCPay says hosting providers including LunaNode may have shut instances down on their own. How much was taken, and through what, is still unknown, and we’ll treat it as unsettled until BTCPay publishes it. At the time of this writing, bitcoin was $77,890.