--- title: BTCPay Server Tells Operators to Shut Down After Hot-Wallet Theft Reports url: >- https://www.cryptocatalyst.news/articles/2026-11-02-btcpay-server-tells-operators-to-shut-down-after-hot-wallet-theft-reports canonical: >- https://www.cryptocatalyst.news/articles/2026-11-02-btcpay-server-tells-operators-to-shut-down-after-hot-wallet-theft-reports date: '2026-11-02T14:08:35.491772+00:00' category: web3 tags: - btcpay - bitcoin - security - hot-wallet - merchants source: CoinDesk source_url: >- https://www.coindesk.com/tech/2026/11/02/btcpay-a-bitcoin-payment-tool-tells-users-to-switch-off-their-servers-after-reports-of-drained-wallets sources: - name: CoinDesk url: >- https://www.coindesk.com/tech/2026/11/02/btcpay-a-bitcoin-payment-tool-tells-users-to-switch-off-their-servers-after-reports-of-drained-wallets - name: CoinTelegraph url: >- https://cointelegraph.com/news/btcpay-server-hot-wallet-thefts-older-versions?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound - name: Decrypt url: >- https://decrypt.co/382324/btcpay-tells-merchants-to-switch-off-servers-amid-hot-wallet-attack-reports publisher: CryptoCatalyst summary: >- BTCPay Server is investigating reports of hot-wallet theft and has urged operators to shut down. The reports appear to involve versions 2.4.1 and older. image: >- https://www.cryptocatalyst.news/images/articles/2026-11-02-btcpay-server-tells-operators-to-shut-down-after-hot-wallet-theft-reports.webp generated_by: automated editorial pipeline --- # BTCPay Server Tells Operators to Shut Down After Hot-Wallet Theft Reports BTCPay Server has urged operators to switch off their servers after reports that attackers drained funds from hot wallets. The project has not confirmed the total losses or announced a fix; its founder said the reports appear to involve software versions older than 2.4.2. ## Key takeaways - BTCPay Server urged operators to shut down their servers after reports of hot-wallet theft. - The reports appear to involve BTCPay Server versions 2.4.1 and older. - The project is investigating and has not announced a loss figure or a fix. - Shutting down a server may interrupt a merchant's Bitcoin payment processing. BTCPay Server, open-source software merchants use to accept Bitcoin payments, has told operators to shut down their servers after reports of unauthorized withdrawals from hot wallets. A hot wallet is connected to the internet, making it convenient for handling payments but more exposed to online attacks. The project says it is investigating. It has not published a loss estimate or announced a fix. BTCPay founder Nicolas Dorier said the reports appear to involve versions older than 2.4.2; Decrypt reported that attacks targeted versions 2.4.1 and earlier. ## Which BTCPay versions are implicated? The reporting points to BTCPay Server versions 2.4.1 and older. That identifies the versions associated with the reports, but does not establish the precise cause or confirm that every installation running them was affected. The project has not yet shared a full incident analysis. This follows an earlier [BTCPay Server security warning](/articles/2026-08-07-btcpay-server-warns-users-critical-flaw-under-active-attack) about a critical flaw under active attack. The current reports are another reminder that merchants running payment infrastructure need to treat security advisories as operational instructions, not just software news. ## What should merchants do now? BTCPay’s immediate instruction is to switch off servers while the investigation continues. Operators should consult the project’s official updates before bringing an affected instance back online; the available reports do not specify a confirmed remediation or recovery timeline. For merchants, the exposure is not only whether Bitcoin was stolen: shutting down payment software can also interrupt checkout. The practical distinction is that a server shutdown reduces ongoing exposure but does not itself establish whether funds were lost or whether an installation is safe to restart. ## FAQ ### Why is BTCPay Server telling users to shut down? The project received reports that attackers drained funds from hot wallets connected to BTCPay servers and urged operators to switch off their servers while it investigates. ### Which BTCPay Server versions were reportedly targeted? Reports point to versions 2.4.1 and older. BTCPay founder Nicolas Dorier said the affected reports appear to involve versions older than 2.4.2. ### Has BTCPay Server confirmed how much Bitcoin was stolen? No. The project has not provided a total loss figure or announced a fix in the reports available. ## Sources This article synthesizes reporting from [CoinDesk](https://www.coindesk.com/tech/2026/11/02/btcpay-a-bitcoin-payment-tool-tells-users-to-switch-off-their-servers-after-reports-of-drained-wallets), [CoinTelegraph](https://cointelegraph.com/news/btcpay-server-hot-wallet-thefts-older-versions?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound), [Decrypt](https://decrypt.co/382324/btcpay-tells-merchants-to-switch-off-servers-amid-hot-wallet-attack-reports), written by an automated editorial pipeline. See https://www.cryptocatalyst.news/editorial-policy. ## How to cite CryptoCatalyst.news, "BTCPay Server Tells Operators to Shut Down After Hot-Wallet Theft Reports", 2026-11-02, https://www.cryptocatalyst.news/articles/2026-11-02-btcpay-server-tells-operators-to-shut-down-after-hot-wallet-theft-reports