On Nov. 1, 2026, BTCPay Server put out an urgent shutdown alert following claims of hackers siphoning bitcoin from hot wallets tied to self-hosted payment gateways. Creator Nicolas Dorier traced the reported breaches to builds older than 2.4.2, adding that public nodes on version 2.4.7 remained completely untouched. The critical warning was issued barely three days after an AI-driven security overhaul patched 85 flaws, highlighting the real-world dangers for platform operators who put off applying software updates.
BTCPay Developers Call for Immediate Shutdown After Bitcoin Wallet Theft#
Around 22:25 UTC on Nov. 1, an urgent bulletin was put out through BTCPay Server’s official channel:
“We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers.”
Admins received instructions to pull their systems offline with the ./btcpay-down.sh script while investigators worked to piece together what went wrong. Core contributor Uncle Rockstar Developer backed up the alert, emphasizing, “Not a drill: shut down your BTCPay Server if you have a hot wallet.”
BTCPay Server functions as open-source code that lets merchants take bitcoin (BTC) payments without depending on traditional payment processors. Infrastructure can be self-hosted by platform operators to retain full control over their funds. That autonomy, however, comes with serious responsibility.
At publication time, developers had shared neither the total bitcoin stolen nor how many merchants suffered losses. No confirmed details were provided in the initial alert regarding how intruders initially gained access to the compromised systems.
Founder Links Security Issue to Older Software Versions as Probe Advances#
BTCPay Server founder Nicolas Dorier later provided a more detailed breakdown of the situation. His initial investigation suggested that the impacted setups were running code released prior to version 2.4.2. Administrator access was reportedly gained by attackers, with digital footprints pointing to flaws hidden within those earlier software builds.
Dorier also noted that public and demo environments operating on version 2.4.7 remained completely untouched by attackers. That detail casts doubt on claims that the newest emergency patch somehow caused the reported vulnerability. It fails to prove that every active setup is entirely safe, however, as a comprehensive technical breakdown has yet to be released by investigators.
Stay in the loop
Get crypto news before the market moves
Join thousands of investors who read our daily briefing.
No spam. Unsubscribe anytime.
Back in August, the development team patched a separate flaw that enabled unauthorized hackers to harvest Lightning Network Daemon (LND) macaroon credentials, which serve as digital authorization keys. That security hole was fixed in version 2.4.2. Developers previously confirmed that BTCPay’s native onchain wallets were not exposed by that particular vulnerability.
Investigators have not yet conclusively established whether the recent thefts stemmed from that original flaw, a different legacy bug, or a combination of multiple security vulnerabilities.
AI Security Upgrade Patched 85 Vulnerabilities Days Before Warning#
The timing adds a particularly interesting layer to the story. On Oct. 29, version 2.4.7 was rolled out by BTCPay Server after receiving vulnerability reports uncovered through Anthropic’s open-source security scanning project. The update patched 85 distinct findings, which included 1 critical flaw, 13 high-severity bugs, 52 medium-level issues, and 19 minor flaws.
These revelations surfaced during a wider surge in AI-driven vulnerability research throughout 2026, as platforms built by tech leaders like Anthropic, OpenAI, and Google showed increasingly advanced capabilities in spotting software flaws. Over 29,000 potential security vulnerabilities were flagged by Anthropic’s scanning effort alone across a six-month stretch, though only a fraction of those findings actually underwent manual review.
The BTCPay situation highlights a crucial gap between identifying software flaws and safeguarding live infrastructure. Servers run by independent operators are not automatically updated when security patches are published.
Merchants Take Servers Offline While Security Investigation Continues#
Several businesses, including Coincards, pulled their BTCPay instances offline immediately after the alert was issued. For store owners, the temporary shutdown forces a tough choice between processing incoming orders and safeguarding funds stored in connected wallets. Dorier once again stressed that hot-wallet reserves should always be capped at amounts operators can comfortably afford to lose.
No official tally of stolen funds, fresh emergency patch, or all-clear notice had been announced in the latest updates provided by the team. Developers were working on a more detailed technical breakdown. The underlying concern reaches far beyond BTCPay: as AI tools speed up vulnerability discovery, can self-hosted payment networks realistically keep pace with the patch cycle?
