BTCPay Server warns of hot-wallet thefts. Shut down old instances and update

In brief

Developing. Last updated 2 November 2026, 08:09 Dubai time (UTC+4).

At 02:25 Dubai time on 2 November, the official BTCPay Server account said it was "receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers". It asked anyone running an instance to shut it down until the investigation is complete. BTCPay has not published a loss figure.

What we know

• The mitigation, verbatim from BTCPay's post: "please shut it down (./btcpay-down.sh) until we complete the investigation."
• Which versions are hit is an early assessment. Nicolas Dorier, BTCPay Server's lead developer, wrote that the project's own public servers, running 2.4.7, were not attacked, and that "it seems reports are on before 2.4.2". He first wrote "on 2.4.2" and later corrected it to "before 2.4.2".
• How the attackers got in is not confirmed. Dorier said the attacker "managed to log in as admin on those instance, we are still trying to figure out how". He later said there are "traces that pre 2.4.2 vulnerabilities were used" and that a blog post will follow.
• The earlier 2.4.2 advisory. BTCPay's 2.4.2 advisory covers a critical flaw in every version before 2.4.2, including the 2.4.2 release candidates. It let an unauthenticated attacker take LND .macaroon credentials and move funds from the Lightning node. BTCPay says that flaw was exploited and funds were stolen, but that its on-chain wallets, including hot wallets, were not affected. BTCPay's official account has not said what caused the new sweeps. Dorier says there are 'traces that pre 2.4.2 vulnerabilities were used' and that 'it doesn't seem to be a new vulnerability'. The advisory itself covers only the LND flaw.

What operators should do

1. Shut down an instance you cannot update right away, using the command above.
2. Update to the latest release (2.4.2 at minimum). The advisory names 2.4.2 as the fixed release and says it also moves LND to 0.21.1. For a standard install the path is Server Settings → Maintenance → Update. Afterwards, check that the admin footer shows the new version. Other installs should follow their usual update process. Dorier says BTCPay's own servers run 2.4.7.
3. If you run LND, check for payments, channel closures or peers you don't recognise, and rotate macaroons on any access route you manage outside BTCPay, as the advisory instructs.
4. Keep hot wallets small. Dorier: "Don't put more than you are ready to lose in hot wallet."

Why it matters

ByteNib's reading: self-hosted payment servers stay on whatever version they were installed with unless someone updates them, so a fix shipped months ago does not protect servers nobody upgraded. Operators should treat any server below 2.4.2 as compromised until BTCPay's postmortem says otherwise. That means checking admin accounts, not just updating.

Sources and scope

• BTCPay Server security advisory for 2.4.2, last updated 30 October 2026.
• BTCPay Server on X, 2 November 2026, 02:25 Dubai time.
• Nicolas Dorier on X: the first update (04:06), the corrected update and correction note (04:28 and 04:30), the hot wallet advice (05:00) and the traces post (05:52). All on 2 November 2026, Dubai time.

All sources were read on 2 November 2026. The "Why it matters" section and the advice to keep hot wallets small and audit admin accounts are ByteNib editorial analysis.

Drafted with AI assistance and reviewed by the editor before publication.

Continue exploring: Cybersecurity analysis, the related implementation tutorial, and the structured learning path.