BTCPay Server is free, open-source software that lets businesses accept Bitcoin payments on their own servers without a payment processor. The trade-off is that it is self-hosted: no central company patches your server, and each operator has to update their own.

On Sunday evening (UTC), Nov. 1, BTCPay began receiving reports of theft and told operators to shut servers down. It also asked VPS hosting providers to take affected instances offline. The reports involved unauthorized Bitcoin and Litecoin payments. A hot wallet is one whose keys live on an internet-connected server, which makes it convenient and also the target.

Which Versions Are Affected?

By early Monday, BTCPay said the attack vector targets v2.4.1 (July 23, 2026) or older. Founder Nicolas Dorier said the investigation was focused on how the attacker was able to log in as an administrator on versions older than v2.4.2, which was released Aug. 7. BTCPay’s current guidance: update to v2.4.7, and take any instance running v2.4.1 or older offline as soon as possible.

Separately, BTCPay disclosed a critical vulnerability on Oct. 29 and shipped v2.4.7 as an emergency update. BleepingComputer reports it was found with Anthropic’s Frontier OSS scanner. BTCPay has not said that flaw caused the thefts, so the two should not be linked without confirmation.

What Do We Not Know?

Quite a lot. BTCPay has not said how many operators lost funds, how much was taken, or the technical steps attackers used to reach the wallets. It is still receiving reports and has asked victims to email its security team and report losses to local authorities.

What Should BTCPay Operators Do?

Based on BTCPay’s guidance as reported:

  • Check your version. If you run v2.4.1 or older, take the instance offline as soon as possible.
  • Update to v2.4.7 through Server Settings, then Maintenance, then Update. Docker users can run the update script from the deployment directory over SSH.
  • If you lost funds, send details to security@btcpayserver.org and report the loss to local authorities.
  • Not from BTCPay’s alert, but standard practice: keep only small balances in server-side hot wallets.

Why It Matters

The August fix came out about three months before these thefts. Attackers appear to be going after instances that never updated, which is a patch-hygiene problem as much as a software one. It also matters for crypto’s security picture this year. Hardware wallets, exchanges, and now self-hosted payment software have all had incidents, and in the self-hosted case the user is the last line of defense. Self-custody removes the middleman, and it also removes whoever would have patched for you.