Is Your BTCPay Server Safe? What the Hot Wallet Drain Investigation Shows

Attackers gained administrator access to outdated BTCPay Server instances and emptied their hot wallets, the BTCPay Server team said after warning operators on Nov. 1, 2026. The project said version 2.4.1, released July 23, 2026, and older releases were affected; it had no credible drain reports on 2.4.7. Founder Nicolas Dorier said the attacker logged in as an administrator but the method is unknown. BTCPay Server is an open-source, self-hosted Bitcoin payment processor whose hot wallets store private keys on the server and can send funds without per-transaction signing. The investigation found traces of vulnerabilities predating version 2.4.2, and the breach is at least the second in three months affecting versions older than that release, which patched an August flaw.