On Nov. 1, 2026 BTCPay Server warned operators to shut down their instances after reports that hot wallets on multiple installations were being swept by unauthorized attackers. The project's alert gave no root cause. Later reporting pointed to older versions (reported as predating 2.4.2, or 2.4.1 and older), with no credible reports affecting the latest 2.4.7 release. As of Nov. 2, the number of affected servers, the total stolen and the intrusion method were all unconfirmed.
We message you the minute a major hack, exploit or fraud is confirmed, with the amount lost and what to do. Free, no spam, stop any time.
As of November 7, 2026, BTCPay Server identified that the attack vector affected instances running version 2.4.1 (released July 23, 2026) or older. The vulnerability was reportedly patched in v2.4.2 on August 7, 2026. Funds were moved to two attacker-linked addresses, with 87% of the money reportedly moved on November 1, 2026, between 14:12 and 22:16 UTC.
As of November 7, 2026, BTCPay Server identified the attack vector as affecting version 2.4.1 (released July 23, 2026) or older, with the vulnerability patched in version 2.4.2 on August 7, 2026. The project advised operators of affected instances to take servers offline and move funds.
BTCPay Server identified the attack vector as affecting version 2.4.1 (July 23, 2026) or older, with the vulnerability patched in version 2.4.2 on August 7, 2026. The project advised operators of affected instances to take servers offline and move funds.
As of November 2, 2026, BTCPay Server identified that the attack vector affected instances running version 2.4.1 or earlier, with no credible reports of drains on version 2.4.7. The vulnerability was reportedly patched in v2.4.2 on August 7, 2026.
BTCPay Server identified the attack vector as affecting version 2.4.1 (July 23, 2026) or earlier, with no credible reports of drains on version 2.4.7. Approximately $1.62 million in 18.38 BTC and 3,405 LTC was moved across 682 sweeps, with 87% occurring on November 1, 2026.
Between October 30 and November 2, 2026, approximately $1.63 million in Bitcoin and Litecoin was traced to two attacker-linked addresses across 682 wallet sweeps. An additional 267 sweeps totaling about $150,000 occurred after BTCPay Server's November 1 warning.
As of the latest reporting, approximately $1.62M-$1.63M in Bitcoin and Litecoin has been traced to two attacker-linked addresses across 682 wallet sweeps between October 30 and November 2, 2026. An additional 267 sweeps totaling about $150,000 occurred after BTCPay Server's November 1 warning.
On November 1, 2026, after BTCPay's warning, an additional 267 wallet sweeps totaling approximately $150,000 occurred. The exploited flaw was fixed in version 2.4.2 on August 7, 2026, and attackers allegedly used admin access on affected servers to drain hot wallets.
On November 1, 2026, BTCPay Server issued a warning to operators to shut down their instances due to reports of hot wallets being drained. Later reporting indicated that the attack vector affected version 2.4.1 and earlier, with no credible reports affecting version 2.4.7.
TokenPost reported that after BTCPay's Nov. 1, 2026 warning, 267 additional wallet sweeps totaling about $150,000 occurred. The Hacker News reported that 87% of the stolen value moved in a single wave on Nov. 1, 2026 between 14:12 and 22:16 UTC. BTCPay also asked affected users to send details and logs to its security team and to replace potentially compromised credentials. No frozen, recovered, or seized funds, arrests, lawsuits, or compensation programs have been reported.
Per investinglive's Bitquery-based reporting as of the morning of Nov. 2, 2026, the 682 wallet sweeps sent about 18.38 BTC and 3,405 LTC to two incident-linked addresses; the report previously listed only the LTC figure. CoinDesk reported that BTCPay's own public servers running 2.4.7 were not attacked, and BTCPay's X post repeated that there are no credible reports affecting 2.4.7. The sources reviewed report no arrests, lawsuits, compensation plans, or frozen or recovered funds.
As of Nov. 2, 2026, BTCPay's incident-response update said the attack vector affects 2.4.1 (released Jul. 23, 2026) and earlier, and that the flaw was originally fixed in 2.4.2 (Aug. 7, 2026), though attackers used a different exploitation method against it. Operators were told to shut down instances with ./btcpay-down.sh and to migrate to a new server with a fresh wallet and seed, even if they had updated in place. Research found no public developments after Nov. 4, 2026 02:25 UTC, and no frozen, recovered, or seized funds have been reported.
As of the morning of Nov. 2, 2026, Bitquery-based reporting (investinglive) said the drains had produced 682 wallet sweeps sending about 18.38 BTC and 3,405 LTC to two incident-linked addresses. Reporting from investinglive also said the attackers used a different method against the vulnerability fixed in 2.4.2, and one source dated the first theft reports to Oct. 30, 2026, which differs from the report's Oct. 31 UTC timing. No frozen, recovered, or seized funds, arrests, lawsuits, or compensation plans have been confirmed in these sources.
As of Nov. 3, 2026, TokenPost reported that BTCPay Server 2.4.1 was released July 23, 2026, and that the attack vector affects that version and earlier, with users told to move to a fresh server and new wallet/seed. TokenPost also reported 267 additional sweeps totaling about $150,000 after BTCPay's Nov. 1 (22:25 UTC) shutdown warning, though it is unclear whether these are included in the earlier 682-sweep, $1.63M tracing figure. BTCPay has not published an official loss total, and the traced funds have not been confirmed as frozen, recovered or seized.
As of Nov. 2, 2026, reporting says BTCPay began receiving reports of the drains on the evening of Oct. 31 UTC, before the public warning on Nov. 1. BTCPay's guidance is to shut down affected instances, move funds to a fresh wallet, rebuild on a new server, and rotate credentials. The research found no verified frozen or recovered funds and no official aggregate loss figure; the Bitquery estimate remains unconfirmed by BTCPay.
As of Nov. 2, 2026, BTCPay founder Nicolas Dorier said the attacker logged in as an administrator on affected servers and the team was still working out how that access was obtained (CoinDesk; Crypto Times). An external Bitquery estimate breaks the losses into about 18.38 BTC and 3,405 LTC across 682 sweeps. A separate report said the attacker's Bitcoin address received about 18.75 BTC, sent about 18.28 BTC onward, and held about 0.47 BTC, though that attribution is unverified.
As of Nov. 2, 2026, BTCPay's statements reportedly told affected users to update their software and told anyone impacted to send details and logs to the security team, per Cointelegraph and LCX coverage. The same reporting found no arrests, lawsuits or compensation arrangements. Figures and wallet addresses remain unconfirmed by BTCPay.
As of late Nov. 2, 2026 (UTC), BTCPay's X post says its incident response has identified the attack vector, and coverage ties it to version 2.4.1 (released July 23, 2026) or older. An external Bitquery investigation reports 3,405 LTC and a traced value of $1,628,450 across 682 sweeps, with more than 99% still in addresses first used in the theft and none reaching a known exchange as of 06:00 UTC on Nov. 2. These figures come from an external on-chain investigation and are not confirmed by BTCPay.
Per the research, BTCPay's incident-response investigation tied the attack vector to version 2.4.1 (dated July 23, 2026) or earlier, and it reported no credible hot-wallet drain reports on 2.4.7 (as reported by BleepingComputer, Yahoo Tech, Cointelegraph and FinanceFeeds). Per Crypto Times (Nov. 2, 2026), founder Nicolas Dorier reportedly published an attacker Bitcoin address, though the research does not include the address itself. As of the latest coverage, no recovery, freeze, arrest, lawsuit or compensation has been reported, and the amount stolen and number of affected servers remain undisclosed.
Per the research compilation (citing PaymentsHighRisk, ABAB News and Blockchain Reporter, as of Nov. 2, 2026), operators were told not to restart affected BTCPay Server instances until the investigation is complete. That goes beyond the earlier Nov. 1 advice to shut instances down. The compilation also reports that BTCPay has no credible reports of hot-wallet drains on 2.4.7, and that no loss totals, victim counts, attacker wallets or recoveries had been disclosed as of Nov. 2.
Per Bitcoin Foundation reporting, attackers appear to have obtained administrator access on affected instances before sweeping hot wallets, and the admin-access pattern is still under investigation (as of Nov. 2, 2026). Per BTCPay statements cited by LCX and Yahoo Tech, operators are asked to submit logs to BTCPay's security team. Per a Crypto Times report dated Nov. 2, 2026, an attacker wallet reportedly received about 18.75 BTC, sent about 18.28 BTC and retained about 0.47 BTC; this on-chain attribution is unverified, and no wallet address was given.
Per the research compilation (citing PaymentsHighRisk, ABAB News and Blockchain Reporter), operators were told not to restart affected BTCPay Server instances until the investigation is complete, which goes beyond the earlier shutdown advice. The compilation also reports that BTCPay says it has no credible reports of hot-wallet drains on 2.4.7, and that no loss totals, victim counts, attacker wallets or recoveries had been disclosed as of Nov. 2, 2026. Most other points in the research repeat facts already in the report.
Per Seoul Economic Daily (via CoinDesk), BTCPay began receiving reports on Oct. 30, 2026 that bitcoin was withdrawn without authorization from merchants' hot wallets, which was before the Nov. 1 shutdown alert. Nothing newer than the Nov. 2 coverage was found: no loss totals, victim counts, frozen or recovered funds, attacker wallet activity, arrests, lawsuits or compensation plans have been disclosed.
Per Tangem, BTCPay founder Nicolas Dorier said on Nov. 1, 2026 that the reports "appear to be related to BTCPay Server versions older than 2.4.2" and that the project's own public server running 2.4.7 had "not been attacked." As of Nov. 2, 2026, the cited coverage (InvestingLive, Crypto.news) still reports no confirmed total loss, no frozen or recovered funds, no arrests, no lawsuits or compensation plan, and no traced attacker wallet addresses or on-chain movements.
Per Odaily and TokenPost, BTCPay's incident-response update says it identified an attack vector targeting instances on version 2.4.1 (released July 23, 2026) or older, and that it has no credible reports of hot wallet drains on 2.4.7. Founder Nicolas Dorier reportedly said the attackers obtained administrator access, though how they got it is still undetermined. Affected admins are asked to email details and logs to security@btcpayserver.org. The total stolen and victim count remain undisclosed as of Nov. 2, 2026.
According to BTCPay Server's own notice, posted on X on Nov. 1, 2026, the project received reports that hot wallets on multiple BTCPay Server installations were being swept by unauthorized attackers. It told operators to run ./btcpay-down.sh and keep systems offline until the investigation finished.
Media coverage continued through Nov. 2, 2026 (CoinDesk, Bitcoin.com and others). The affected asset is consistently identified as bitcoin held in Bitcoin hot wallets, meaning wallets directly connected to the server.
The initial alert did not disclose a technical root cause. Later reporting (Cybersecurity News and Coinfomania, per the research) attributed the issue to older versions: one account says versions predating 2.4.2, another says 2.4.1 or older. These reports also say there were no credible reports of drains on the latest 2.4.7 release. One report said affected servers appeared to have had administrator-level access compromised. The official alert did not confirm that detail.
Separately, a BTCPay Server security post dated Oct. 8 describes a previously disclosed vulnerability that let an attacker obtain LND admin macaroon credentials and access connected LND wallets. The post asks affected users to report on-chain addresses and transaction details. The research does not state whether that incident is linked to the Nov. 1 drains, so the two should not be assumed to be the same event.
The exact attack method for the Nov. 1 drains has not been confirmed. Reporting points to older, unpatched BTCPay Server versions and, in one unconfirmed report, compromised administrator-level access. Because the funds sat in hot wallets connected to the servers, an attacker with sufficient access could move them out without any further approval. One crypto news item in the research also mentions bots probing exposed payment servers to steal administrative keys. That item is only a headline in the source list, and it is not confirmed as related to this incident.
The Oct. 8 post describes a different, earlier vulnerability that exposed LND admin macaroon credentials. A macaroon is an authentication token for an LND node, and the admin one grants broad control over the node's wallet. Any link to the Nov. 1 events is unconfirmed.
Unknown. No attacker wallet addresses have been published. No confirmed tracing to mixers, bridges or exchanges was found, and no freezes or recoveries were reported for the Nov. 1-2 incident.
On Nov. 1 BTCPay Server told operators to shut down immediately and stay offline while it investigated. It has not publicly disclosed the root cause, total losses or a full list of affected servers. No compensation, reimbursement or insurance fund was reported. No regulator or police action was reported. The reports do not describe a formal platform-wide withdrawal pause. BTCPay Server is self-hosted software, so each operator controls their own server.
The number of affected servers and total losses are unconfirmed. Operators of self-hosted BTCPay instances, such as merchants accepting bitcoin, were told to take servers offline, which interrupts their payment acceptance. The available reports include no verified Bitcoin price reaction. No solid sample of user reactions was available beyond expressions of concern and caution.
55% negative · 5% positive · the rest neutral · themes: urgent shutdown advice, uncertainty over root cause and scale, outdated software risk, self-hosting security responsibility
How we report: Sentinel reads news, investigators' posts, company statements and on-chain data, attributes every claim to its source and marks unconfirmed numbers as reported. Severity measures size and systemic risk; the response score measures how fast and transparently users were protected. Not financial advice and not a finding of guilt. Corrections: contact us.
New exploit reports, major incidents and security updates from VaultX. Free. You choose below; nothing starts until you opt in.
On Telegram, press Start in the bot to subscribe. New reports are also posted on our alerts channel. Not financial advice.
VaultX