BTCPay Server is urging operators of older installations to rebuild their payment infrastructure after reports of Bitcoin and Litecoin stolen from hot wallets. In its November 2, 2026 security advisory, the open-source payment processor identified installations running version 2.4.1 or earlier as targets. Updating previously exposed software alone may not remove an intruder’s access, making new infrastructure and wallet keys necessary in the affected risk group.

The platform allows merchants to accept cryptocurrency through self-hosted checkout and invoicing software. A hot wallet keeps private spending keys on an internet-connected server, so an attacker gaining sufficiently privileged access may move funds. A watch-only wallet or external hardware signer separates spending keys from the payment server. BitcoinVersus.Tech previously examined the importance of isolating cryptographic keys from application systems.

Historical official explanation of BTCPay Server’s payment architecture; published in 2019, before the 2026 attack. Credit: BTCPay Server.

The November 1 theft reports targeted older versions

Maintainers said reports began on November 1. Their published incident timeline records a wallet drain at 13:46 UTC and the first emailed theft report at 20:56 UTC the same day. The project notified hosting providers and warned users on X at 22:25 UTC. The full exploitation timeline has not been established; the team cautioned against treating identified destination-wallet balances as confirmed total losses.

The affected versions were released before the August 7 security update. BTCPay stated that attackers used a different method to exploit the vulnerability addressed by version 2.4.2. Crucially, the maintainers reported no observed impact from the November attacks on servers already running 2.4.2 or later when the November 1 warning was issued. Absence of observed impact is not a promise that every server is invulnerable.

BTCPay Server’s official November 2 incident update on X. Original announcement linked from the project’s security advisory. Credit: BTCPay Server.

Updating a compromised server is not enough

For installations that were running 2.4.1 or earlier, the project advises creating a new wallet with a fresh seed on a trusted device, sweeping remaining hot-wallet funds, taking the old server offline while preserving evidence, and provisioning a fresh machine. Operators should revoke exposed credentials, including relevant SSH, API, hosting and Lightning keys. They should not restore a complete compromised server image or reuse the old wallet seed. The guidance also applies to an older server upgraded only after the warning.

The October 29 BTCPay Server 2.4.7 release separately fixed 85 scanner-reported security findings: one critical, 13 high, 52 medium and 19 low, according to the maintainers’ severity classifications. Those counts describe fixes in the later release, not 85 confirmed attacks or an established explanation for the November thefts. Comparable patch-discipline issues were discussed in BitcoinVersus.Tech’s reporting on Bitcoin Core security updates.

Official BTCPay Server tutorial on connecting a hardware wallet with BTCPay Vault. Published 2023; background custody guidance, not a 2026 incident demonstration. Credit: BTCPay Server.

BTCPay recommends current supported releases for ongoing operations. The logged-in page footer shows the installed version, while official server documentation describes updating through Server Settings and Maintenance or the standard Docker deployment. For operators rebuilding a potentially compromised machine, incident-recovery guidance takes precedence over routine in-place patching.

Keeping wallet keys away from the server

The distinction between wallet custody and server security matters. The project said funds whose spending keys were held off-server, including supported hardware wallets, were not affected by the reported thefts. Still, a previously vulnerable server needs rebuilding even when keys were stored externally. BTCPay’s wallet documentation explains the different signing arrangements, while another recent Bitcoin wallet incident demonstrates why application-level vulnerabilities require separate assessment.

Lightning services deserve specific attention because credentials and channel-related operational data can reside in connected systems. BitcoinVersus.Tech recently covered Core Lightning security fixes, illustrating that protecting signing keys does not eliminate all software exposure. BTCPay asks affected operators to report incidents to its security team without sending wallet seeds, private keys or passwords. No verified aggregate theft amount was provided in the official advisory.

Primary documents: BTCPay Server’s November 2 incident advisory, version 2.4.7 release notes and official maintenance documentation. Reported thefts remain under investigation; no independently audited global loss estimate is asserted.

Editor’s Note: Reported attack dates, version thresholds and remediation steps derive from BTCPay Server’s November 2, 2026 advisory. The 85 security findings represent separate October 29 release-note classifications; they are not established as causes of the thefts. The featured cover is conceptual editorial artwork, the chart displays the project’s numbers, and the two official videos predate the incident. No total stolen amount or independent exploit reproduction is claimed.

Support BitcoinVersus.Tech

To support independent verification and reporting, scan the original approved QR code below for an optional 5,000-satoshi contribution. On a phone, open the article on another screen and scan using a compatible Bitcoin wallet, or use the wallet’s supported image-scanning function. Confirm the recipient and amount before payment.

We volunteer daily to ensure the information on this platform is Verifiably True. If you would like to support the research, please scan QR code.