Bitcoin Payment Processor Btcpay Hit by Hot Wallet Theft Reports

Btcpay Developers Urge Immediate Shutdown as Bitcoin Wallets Are Swept

At approximately 22:25 UTC on Nov. 1, Btcpay Server’s official account published an urgent notice:

“We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers.”

Operators were instructed to shut down their instances using the ./btcpay-down.sh command until investigators could establish what happened. Core contributor Uncle Rockstar Developer reinforced the warning, declaring, “Not a drill: shut down your BTCPay Server if you have a hot wallet.”

Btcpay Server is open-source software allowing merchants to accept bitcoin (BTC) payments without relying on a conventional payment intermediary. Operators can host the software themselves and manage their own wallet infrastructure. That independence carries responsibility.

At press time, developers had disclosed neither the total bitcoin stolen nor the number of affected merchants. The initial alert also provided no confirmed account of how attackers first entered the compromised systems.

Founder Points to Older Versions as Investigation Narrows

Btcpay Server founder Nicolas Dorier subsequently offered a more specific explanation. His preliminary findings indicated that affected deployments were running software predating version 2.4.2. Attackers reportedly obtained administrator access, with forensic traces pointing toward vulnerabilities present in those older releases.

Dorier also indicated that public and demonstration servers running version 2.4.7 had not been attacked. That distinction throws cold water on the possibility that the latest emergency release itself introduced the reported compromise. It does not establish that every current installation is immune, however, and investigators have yet to publish a complete technical account.

The project previously addressed a separate vulnerability in August that allowed unauthenticated attackers to obtain Lightning Network Daemon (LND) macaroon credentials, which function as authorization tokens. That flaw was corrected in version 2.4.2. Developers previously said Btcpay’s own onchain wallets were not exposed through that specific vulnerability.

Whether the latest thefts involved the same weakness, another older flaw or multiple weaknesses has not been conclusively established.

AI Security Overhaul Fixed 85 Flaws Just Days Before Alert

The timing adds another twist. On Oct. 29, Btcpay Server released version 2.4.7 after receiving vulnerability reports generated through Anthropic’s open-source security scanning initiative. The release addressed 85 findings, including one critical, 13 high-severity, 52 medium-severity, and 19 low-severity issues.

The disclosures came amid a broader expansion of AI-assisted vulnerability research in 2026, as systems developed by AI giants like Anthropic, OpenAI, and Google demonstrated increasingly sophisticated capabilities for identifying software weaknesses. Anthropic’s scanning initiative alone reported more than 29,000 candidate vulnerabilities across six months, although only a portion underwent manual review.

The Btcpay incident illustrates a critical distinction between discovering vulnerabilities and protecting deployed software. Publishing fixes does not automatically update independently operated servers.

Merchants Pull Servers Offline as Investigation Continues

Businesses, including Coincards, took Btcpay installations offline following the warning. For merchants, the interruption creates an immediate trade-off between payment availability and protecting funds accessible through connected wallets. Dorier reiterated the importance of limiting hot-wallet balances to amounts operators can afford to lose.

No definitive loss estimate, new incident-specific patch or all-clear had been announced in the supplied updates. Developers were preparing a fuller explanation. The troubling question extends beyond Btcpay: As AI systems accelerate vulnerability discovery, can independently operated payment infrastructure keep pace with the fixes?

The self-hosted crypto payment processor alerted on a critical vulnerability that was being actively exploited by threat actors and recommended…