BTCPay Server Hot Wallet Incident: What Merchants Need to Know and Do Now

02/11/2026

On Sunday, 1 November 2026, the BTCPay Server project asked everyone running an instance to shut it down after reports that hot wallets on BTCPay servers were being swept by unauthorized attackers. If you accept bitcoin through a self-hosted BTCPay Server, here is what is confirmed so far, what it means for your checkout, and the steps worth taking today.

What happened

Around 22:25 UTC on 1 November, BTCPay Server posted on X: “We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers. If you're running an instance, please shut it down (./btcpay-down.sh) until we complete the investigation.”

According to CoinDesk, founder Nicolas Dorier later said the reports “appear to involve BTCPay Server releases older than version 2.4.2”, that an attacker logged in as an administrator on affected servers, and that the project's own public servers running 2.4.7 “were not attacked”. The team has not yet said how the attacker obtained admin access.

As of publication, no loss total, no count of affected servers and no root cause have been disclosed, and no all-clear has been issued (Bitcoin.com News). Version 2.4.7, released on 29 October, fixed 85 security findings, including one critical and 13 high-severity issues; the team has not linked that release to the incident (release notes).

Why hot wallets are the weak point

A hot wallet keeps the wallet's seed on an internet-connected server so it can sign transactions automatically, for example for refunds or payouts. BTCPay's own documentation marks this option as one that “comes with security implications”. Anyone who gains admin access to the server can move the funds. Because every BTCPay instance is run by the merchant, the project cannot patch or shut down servers centrally: each operator is responsible for updates, access control and monitoring.

What this means for merchants

Checkout downtime. Shutting down the server stops invoices from being created. Every hour offline is lost sales, especially for stores where bitcoin is a main payment method.
Possible fund exposure. Merchants with a hot wallet enabled on an older release should treat the balance as at risk until the investigation ends.
Unclear timeline. With no root cause published yet, there is no fixed date for restarting safely.

What to do now

Follow the official instruction: shut down your instance with ./btcpay-down.sh and keep it offline until BTCPay publishes an all-clear.
Check which version you run. Releases older than 2.4.2 are named in the preliminary findings.
Before restarting, move any remaining hot-wallet balance to a wallet whose keys are not on the server, and keep future hot balances to amounts you can afford to lose, as Dorier advised.
Review admin accounts, rotate passwords and API keys, and enable two-factor authentication.
Tell customers which payment methods are available meanwhile, so orders are not abandoned.
Decide whether self-hosting still fits your team. Running a payment server means owning its security around the clock.

Keep accepting crypto while you investigate

If your BTCPay checkout is offline, a hosted gateway can keep crypto payments running while you decide on your long-term setup. With the PassimPay crypto payment gateway, there is no server to maintain: you connect a CMS plugin, payment link or API and start accepting BTC, USDT and other coins (74+ supported) through a Bitcoin payment gateway or USDT payment gateway. Settlement options such as automatic withdrawal let you move funds to your own wallet on a schedule instead of keeping large balances in one place.

Comparing options? See our guide to BTCPay Server alternatives and our security feature comparison of crypto gateways.

We will update this article when BTCPay Server publishes its full findings.

FAQ

Is BTCPay Server safe to use right now?
As of 2 November 2026, BTCPay Server asks operators to keep instances shut down until its investigation is complete. Follow its official channels for the all-clear.

Which versions are affected?
Preliminary findings point to releases older than 2.4.2. The shutdown request was not limited to those versions.

Were funds stolen?
BTCPay Server says hot wallets were swept on some servers. No loss total or number of affected merchants has been published.

Can I keep accepting bitcoin while my server is offline?
Yes. A hosted gateway such as PassimPay lets you accept BTC, USDT and other coins without running your own server, via plugins, payment links or API.

What is the difference between a hot wallet and a hosted gateway?
A hot wallet stores signing keys on your own internet-connected server, so its security depends on how you run it. With a hosted gateway, the provider runs the infrastructure and you withdraw funds to your own wallet.

Sources: