Funds Stolen from Hot Wallets of Older BTCPay Instances
Start here
AI-assisted source synthesis · not an independent investigation.
On November 2, 2026, the founder of BTCPay Server stated that a recent incident involving funds being transferred out of hot wallets affected servers running version 2.4.1 or earlier. The attacker logged into the servers as an administrator and transferred the funds; the team is still investigating how the breach occurred. BTCPay recommends that operators shut down their instances until the investigation is complete; the official public servers running version 2.4.7 were not attacked. The team said that operators who have updated at least once since the release of version 2.4.2 do not need to panic, and reminded users not to store excessive funds in hot wallets.
AI-written from reports · updated 17 hours ago
Timeline
Follow the reporting to see the different sides of the story.
- CryptopolitanBTCPay Server founder says attackers logged into outdated servers as administrators and transferred out hot wallet funds
The BTCPay Server founder said that the recent incident involving hot wallet funds being transferred out affected servers running version 2.4.1 or earlier, with attackers logging in as administrators; the team is still investigating how the intrusion occurred. BTCPay recommends that operators shut down their instances before the investigation concludes; the official public server running 2.4.7 was not attacked. The team said operators who have updated at least once since the release of 2.4.2 do not need to panic, and reminded users not to store excessive funds in hot wallets.
Heat over time
Current heat 6·Peak over the comparable range 10 (Nov 2 18:00)·Change over the comparable range in the last 24 hours –
Trends compare only the same entities that were fully and continuously observed, so the range can be narrower than the current heat statistics. Move the pointer or tap the chart to read hourly heat; arrow keys work on a keyboard.