On November 1, 2026, open-source Bitcoin payment processor BTCPay Server issued an emergency shutdown warning after discovering that attackers were actively stealing funds from merchant hot wallets.
The project instructed operators running self-hosted servers to manually execute a shutdown script and take their instances offline while its security team investigates the attack. According to founder Nicolas Dorier, initial findings show that hackers gained top-level administrator access to systems running version 2.4.1 or older.
🚨 We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers.
If you’re running an instance, please shut it down (./btcpay-down.sh) until we complete the investigation.
— BTCPay Server (@BtcpayServer) November 1, 2026
Despite the severity of the incident, BTCPay Server said there were no credible reports of stolen funds from installations running the latest version, 2.4.7. The total amount of Bitcoin stolen and the number of affected merchants remain unknown. Investigators are still trying to determine how attackers bypassed the platform’s security.
The incident comes just months after an August exploit allowed remote attackers to steal funds by accessing Lightning Network Daemon credential files on BTCPay Server versions older than 2.4.2. Core Lightning developers also issued an urgent security warning in October after confirming that attackers are actively targeting unpatched Bitcoin Lightning Network nodes.
Read also: What a Week! Binance Loses $6.3 Billion Allegedly to North Korean Hackers
Critics question how hot wallets remain a risk to self-custody
The breach highlights a common misunderstanding about the security of funds held on internet-connected wallets. When a decentralized platform suffers a hack, critics often use the incident to question whether self-custody is safe.
However, X user @2528 rejected this argument, pointing out that keeping Bitcoin in a hot wallet on an active server carries similar risks to storing funds on a centralized exchange.
According to the user, proper self-custody requires keeping most assets offline in cold storage and leaving only small amounts in hot wallets for daily transactions. The commentator also argued that centralized exchanges face similar internet-based security risks, pointing to a recent incident in which Binance reportedly lost more than $6 billion from its own hot wallets.
@BtcpayServer 热钱包被扫就喊自托管不安全？？
这锅甩得挺远
挂服务器上的热钱包 跟交易所热钱包一个性质 联网就是靶子
真正自托管是大头冷钱包离线 热的只留花销
币安丢63亿也是热钱包 咋不说托管不安全
说白了 别把热钱包跟自己掌握私钥画等号— 2528 (@zhaiynbaba) November 2, 2026
Another X user @Bam explained that once an attacker gains administrator-level access, victims should assume their wallet recovery seed phrase has been exposed. Bam advised affected users to use a completely isolated device to access their compromised wallet and transfer any remaining funds to a new wallet with a fresh seed phrase.
If the attacker managed to log in as admin on victims servers then its safe to assume their seed is compromised and shutting down severs is not sufficient. They should assume the seed is compromised and they need to import it onto another wallet (since the servers should stay offline) then send it to another wallet with a trust/new seed. So a wallet for recovery and a wallet for migration.
— Bam 🎰 (@bamskki) November 2, 2026
Shutting down the affected server may stop further activity, but it does not guarantee that the funds connected to the compromised wallet are safe.
How software updates could help hackers target outdated servers with vulnerabilities
The timing of the BTCPay Server attack raises concerns about how quickly hackers can exploit known software vulnerabilities. On October 29, just days before the emergency shutdown warning, BTCPay Server developers released version 2.4.7 to address 85 security findings, including one critical vulnerability.
It remains unclear whether attackers exploited any of these previously identified weaknesses or discovered a separate way into the platform. However, the short period between the security update and the reported attack raises questions about how quickly hackers can study public code changes and use them to target operators who have not updated their software.
This also points to the growing possibility of automated attacks against outdated systems. A user on X @Michael suggested that attackers may be using artificial intelligence to scan networks for newly disclosed vulnerabilities and quickly execute exploit scripts against systems that have not installed the necessary updates.
Michael argued that developers should also use AI-powered security tools to identify and fix vulnerabilities before attackers can exploit them.
@BtcpayServer Seems obvious to me that they’re using AI to test weaknesses in every system, then running exploits…best defense is to run AI white hat tests and find holes before the scammers.
— Michael McMahon (@mmcmahon09) November 1, 2026
For open-source projects such as BTCPay Server, transparency is an important part of building trust. However, publicly disclosing security fixes can also give attackers useful information about weaknesses in older software versions.
This creates additional pressure on operators to install security updates as soon as they become available. Even when developers successfully identify and fix vulnerabilities, users who continue running outdated versions may remain exposed to attacks.
Enjoyed this? Bookmark DeFi Planet, explore related topics, and follow us on Twitter, LinkedIn, Facebook, Instagram, Threads, and CoinMarketCap Community for seamless access to high-quality industry insights.
Take control of your crypto portfolio with DEFI PLANET PRO, DeFi Planet’s suite of analytics tools.
