BTCPay hot wallets accessed without authorization and instances requested to be shut down
Start here
AI-assisted source synthesis · not an independent investigation.
On November 2, 2026, BTCPay Server warned that unauthorized attackers were accessing and emptying hot wallets, and asked instance administrators to take the platforms offline using the shutdown command until the investigation was complete. The project team has not yet disclosed the root cause of the attack, the number of affected servers, or the amount stolen. BTCPay Server advised operators to check server activity, wallet balances, and transaction records; if signing keys are suspected to have been compromised, they should no longer be used. Publicly available information currently only shows that the incident remains under investigation, with no further response details disclosed.
AI-written from reports · updated 15 hours ago
Timeline
Follow the reporting to see the different sides of the story.
- CryptopolitanBTCPay Server warns operators to urgently shut down instances after hot wallets are attacked
BTCPay Server says unauthorized attackers are accessing and draining hot wallets, and has urged instance administrators to take the platform offline using the shutdown command until the investigation is complete. The project has not yet disclosed the root cause of the attack, the number of affected servers, or the amount stolen; operators should check server activity, wallet balances, and transaction records, and suspected compromised signing keys should not be used further.
Heat over time
Current heat 6·Peak over the comparable range 10 (Nov 2 17:00)·Change over the comparable range in the last 24 hours –
Trends compare only the same entities that were fully and continuously observed, so the range can be narrower than the current heat statistics. Move the pointer or tap the chart to read hourly heat; arrow keys work on a keyboard.