← The Polylog Crypto Intelligence Brief
Morning Edition · Monday, November 2, 2026Published at 12:45 AM EST · New York
BTCPay Server Tells Merchants to Shut Down Servers After Hot Wallets Are Drained
The open-source bitcoin payment processor has given no loss figure and no fix, and its founder says the reports appear to involve versions older than 2.4.2, the release that patched a separate wallet-draining attack in August.
BTCPay Server, the self-hosted payment software that many bitcoin merchants run on their own machines, has urged users to shut down their instances after reports that attackers emptied hot wallets stored on those servers. CoinDesk reports that the project says it is still investigating and has not given a loss figure or announced a fix. Nicolas Dorier, BTCPay's founder, said the reports appear to involve releases older than version 2.4.2.
The attack method has not been confirmed. What is known is how the wallets are built. When a merchant creates a hot on-chain wallet inside BTCPay, the seed phrase that controls the coins is stored on the server itself, and that server is connected to the internet. Anyone who gains control of the server or of its stored secrets can sign transactions. TFTC's summary of the project's guidance tells affected users to move their funds to a wallet whose keys BTCPay has never held. The keys of an existing hot wallet cannot be rotated, so a leaked seed stays usable for as long as funds remain at that address.
This is the second BTCPay incident in three months. In August, version 2.4.2 shipped to patch an active exploit that drained merchants' Lightning node wallets. The project has not said whether the November reports share an attack path with the August flaw. If they do, the losses would fall on operators who never installed the August patch rather than on a new vulnerability. Merchant setups that use watch-only wallets, where BTCPay holds only public keys and the signing keys stay in hardware or offline wallets, are not exposed to this kind of theft.
What this means
The exposure affects small merchants who run their own servers. Many of them treat BTCPay as an appliance and do not update it, and the software stores spending keys on an internet-connected server. Self-hosted payment infrastructure is the commercial core of the "use bitcoin as money" argument. Every incident like this raises the effective cost of self-custody for businesses and pushes them toward custodial processors, which re-creates the counterparty risk bitcoin was designed to remove. Two outcomes are plausible, and the deciding fact is whether a new vulnerability exists. If the drains trace only to unpatched servers older than 2.4.2, the likelier result is a contained loss and a push for automatic updates and watch-only defaults within weeks. If they trace to a flaw in current releases, expect a larger disclosure and merchants leaving for custodial alternatives over the following months. Publication of a root cause affecting 2.4.2 or later would prove the contained reading wrong.
Part of a tracked trend
Unaudited Open-Source Crypto Code Surfaces at Scale
Coordinated volunteer and AI-assisted review keeps exposing large backlogs of undiscovered defects in the open-source libraries that wallets, nodes and protocols depend on, so disclosure waves — not novel attacker research — become a recurring driver of emergency patches and incident risk across the ecosystem.
Townsquare
Start a discussion in Townsquare.
More from this edition
- FBI Says North Korea Stole $6.3 Billion From Binance, and About Half Is Frozen
- Binance Customers Withdraw About $3.6 Billion Net After Exchange Reopens Withdrawals
- Zcash Developers Set November 5 Target for NU7 Upgrade That Cuts Blocks to 25 Seconds
- Ethereum Researchers Propose Running Post-Quantum Signature Aggregation on Layer 2s
- Fake Airdrop App on Solana Seeker Store and Initia Minting Flaw Lead Week of Smaller Thefts
- Crypto Industry PACs Back Republicans as Polls Favor Democrats Ahead of Tuesday's Midterms
- Circle Opens Its Cross-Chain Transfer Protocol to Issuer-Run Tokens on Arc
Comments
0No comments yet.