Bitcoin news: BTCPay Server told merchants to go offline after attackers swept hot wallets on 2.4.1 or older. Here is who is exposed.
In today’s Bitcoin news, BTCPay Server, the free open-d every operator to shut down their instance after reports that attackers were sweeping the hot wallets on merchant servers. Less than six hours later, the culprit was old software
At 04:07 UTC on Monday, the project said its investigation had found an attack vector aimed at servers running version 2.4.1, released on July 23, or older. It has “no credible reports” of drains on the current 2.4.7. BTCPay has not said how much was stolen or how many stores were hit.
That makes this a different kind of Bitcoin news from last week’s Binance hack. No exchange was breached. Merchants who run their own payment stack, the people self-custody is meant to protect, were the target.
So who was exposed, and what should store owners do now?
Market Intelligence: Crypto Security Analyst Recommends Best Anonymous Crypto Wallets
What Happened to the BTCPay Server Hot Wallets?
An attacker logged in as admin on older servers and emptied the hot wallets. BTCPay Server raised the alarm at 22:25 UTC on Sunday and asked operators to run its shutdown script “until we complete the investigation.”
Two hours later, founder Nicolas Dorier said the project’s own public servers on 2.4.7 were not attacked. “The attacker managed to log in as admin on those instance, we are still trying to figure out how,” he wrote.
The update followed at 04:07 UTC:
https://x.com/BtcpayServer/status/2117106238123123008
A hot wallet keeps its signing keys on the server itself, so it can pay out refunds and payouts automatically. Anyone with admin rights on that server can send the coins too.
Hosting providers moved fast. BTCPay thanked LunaNode and others for shutting down older hosted instances on their own, so some merchants may find their store offline on Monday.
The version history is the story. 2.4.1 shipped on July 23. Two weeks later, 2.4.2 fixed a critical flaw the team said was “being actively exploited,” and five more releases followed, ending with Thursday’s 2.4.7, which fixed 85 findings from an AI security scan Anthropic ran for the project.
Whether this is the same hole as August’s is still open. Dorier said a blog post with more detail is coming.
Is Your BTCPay Server Store Exposed?
Only if it still runs 2.4.1 or older, on what the project knows so far. “For those who already updated at least once since the release of 2.4.2, there is no reason to panic,” Dorier wrote at 04:10 UTC.
- Check the version. Anything at 2.4.1 or below stays offline until it is updated.
- Update to 2.4.7. Admins can click Update under Server Settings → Maintenance. Docker installs run the
btcpay-update.shscript over SSH, and Umbrel or Start9 users install it from their platform, as BTCPay’s guide sets out. - Keep the hot wallet thin. Dorier’s own advice: “don’t keep too much in your Hot Wallet.” Sweep sales to cold storage and leave only what refunds need.
- Report a drain. Victims are asked to send details and logs to security@btcpayserver.org.
The reported drains all hit hot wallets. Stores that receive into a watch-only wallet keep their signing keys off the server altogether.
DISCOVER:Binance Hacker Sits on $1.4 Billion in Bitcoin, Triple a Week of ETF Buying
Did This Bitcoin News Move the BTC Price?
No. BTC sat at $77,890 when the alert went out and traded at $78,102 on Binance at 07:40 UTC on Monday, up 0.3% in a day. The market is still chewing on last week’s Binance hack.
That hack set the floor. Bitcoin fell to $76,326 on October 30, right on the 200-day EMA (exponential moving average), now at $76,512, and buyers have held above it for three days. Above, the 50-day EMA at $80,293 is now overhead, and $81,971, the October 29 high before the hack, caps the range.
The Fear & Greed Index reads 37, fear, and BTC is down 2.5% on the week.
August 5 to November 2, 2026: BTCUSDT 1D chart
| Outlook | Trigger | Level to watch |
|---|---|---|
| Rebound | A daily close above $80,293 | $81,971, the October 29 high |
| Holding pattern | Holding between $76,326 and $80,293 | A range between the two EMAs |
| Sell-off | A daily close below $76,326 | $74,968, the September 15 low |
Market Intelligence: Crypto Analyst Predicts Best Low-Cap Crypto
