BTCPay warns that server hot wallets were attacked
Start here
AI-assisted source synthesis · not an independent investigation.
On November 2, 2026, BTCPay Server stated that the hot wallets on some servers had been emptied by unauthorized attackers and urged users to shut down the affected instances to assist with the investigation. BTCPay is open-source cryptocurrency payment software that allows merchants to deploy their own servers and receive bitcoin directly into online wallets. Reports indicated that if a server is compromised, assets may be automatically transferred out; the system has no “master switch” to shut down all instances centrally. BTCPay advised users running instances to execute `./btcpay-down.sh` to shut down the servers. The reports did not provide information such as the number of affected servers, the amount of losses, or when the attack occurred.
AI-written from reports · updated 13 hours ago
Timeline
Follow the reporting to see the different sides of the story.
- PYMNTSBTCPay warns that crypto payment servers have been attacked, urges users to shut down servers
After discovering that hot wallets on some BTCPay Server instances had been emptied by unauthorized attackers, BTCPay urged users to shut down their instances to assist with the investigation. Its open-source software allows merchants to self-host servers and receive bitcoin directly into internet-connected wallets; when a server is compromised, assets may be transferred out automatically, and there is no unified “master switch” to shut them all down. BTCPay recommends that users running instances execute `./btcpay-down.sh`.
Heat over time
Current heat 7·Peak over the comparable range 10 (Nov 3 00:00)·Change over the comparable range in the last 24 hours –
Trends compare only the same entities that were fully and continuously observed, so the range can be narrower than the current heat statistics. Move the pointer or tap the chart to read hourly heat; arrow keys work on a keyboard.