Security Incident Affecting BTCPay Server 2.4.1 and Earlier

Here is what the sources I could find say as of Monday, November 2, 2026. The X post itself is short: it points to a BTCPay Server blog advisory and asks anyone affected to send details and logs to [email protected]. I couldn't open that blog post, so the details below come from news coverage.

On November 1, BTCPay told operators it had received reports of hot wallets on BTCPay instances being emptied, and advised shutting servers down with the ./btcpay-down.sh script. On November 2, the project said its investigation had identified an attack path targeting instances running version 2.4.1 (released July 23, 2026) or earlier. Its own public servers, running 2.4.7, were not attacked, and no credible drain reports have come from 2.4.7 users. BleepingComputer and PANews both report this, and Parameter reports that intruders obtained administrator-level credentials, though how they got in is still unclear.

No one has published the number of affected installations or the total amount stolen, so the size of the loss is unknown. The project has asked people to update to 2.4.7 through Server Settings, then Maintenance, then Update, and to keep their logs. This follows an August 2026 exploit that BTCPay patched in 2.4.2, so any server still on an older build should be treated as exposed.