BTCPay Server warns operators to shut down servers as attackers drain Bitcoin hot wallets
CRYPTOAnthropicredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
BTCPay Server's 1 November 2026 notice says hot wallets on some servers are being swept by unauthorised attackers, and it tells operators to shut down with ./btcpay-down.sh until the investigation finishes. Early reports point to installations older than 2.4.2 and attackers logging in as administrators, but how they got in is unconfirmed, and no loss total has been published.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Shut down any BTCPay Server instance using ./btcpay-down.sh and keep it offline until the project issues further guidance.
- Check whether the installation runs a version older than 2.4.2, as early reports link the attacks to such versions.
- Do not treat updating alone as resolving an active compromise while the investigation is ongoing.
- Follow official BTCPay Server channels to tell confirmed developer instructions apart from community reports.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Cyber Security News
Who and what is in it
Companies
Products