BTCPay Server said on Nov. 1, 2026, that unauthorized attackers were draining hot wallets on some payment-processing instances. Its investigation identified an attack vector affecting version 2.4.1 and earlier versions. The team said it had no confirmed reports of theft from hot wallets on version 2.4.7.
Developers asked anyone running a BTCPay Server instance to shut it down until the investigation is complete. Instances run through hosting providers may already have been shut down automatically.
