BTCPay Server, an open‑source Bitcoin payment processor, issued an urgent shutdown warning on Nov. 1, 2026 after reports that attackers were sweeping bitcoin from hot wallets attached to self‑hosted payment servers. The alert, posted by the project's official account at roughly 22:25 UTC, instructed operators to bring their instances offline using the ./btcpay-down.sh command until the cause of the breach could be determined. Core contributor “Uncle Rockstar Developer” emphasized the seriousness, stating, “Not a drill: shut down your BTCPay Server if you have a hot wallet.”

BTC / USD
Source: CoinGecko. Prices are indicative.

Investigation points to legacy versions

Founder Nicolas Durier later clarified that the compromised deployments were running BTCPay Server versions predating 2.4.2. He said forensic traces indicated attackers gained administrator access through vulnerabilities present in those older releases. By contrast, public and demonstration servers running the newly released 2.4.7 version appeared unaffected, suggesting the breach was not caused by the latest code update. The earlier version 2.4.2 had already patched a separate vulnerability that allowed unauthenticated access to Lightning Network Daemon macaroon credentials, but it remains unclear whether the current theft involved that flaw or another older issue.

AI‑driven security overhaul preceded the incident

Just days before the emergency notice, BTCPay Server rolled out version 2.4.7 on Oct. 29, incorporating fixes for 85 vulnerabilities identified through Anthropic’s open‑source security scanning initiative. The patch addressed one critical, 13 high‑severity, 52 medium‑severity, and 19 low‑severity findings. While the AI‑assisted review highlighted the growing role of machine‑learning tools in vulnerability discovery, the incident underscores the gap between publishing patches and operators actually applying them. Many merchants, including Coincards, took their BTCPay installations offline immediately after the warning, sacrificing payment availability to protect funds.

What to watch next

The BTCPay community has pledged a more detailed technical report, which should reveal whether the theft exploited a known flaw or a new attack vector. Observers will also monitor how quickly merchants adopt version 2.4.7 and future updates, as well as any guidance from the broader Bitcoin infrastructure on hot‑wallet best practices. The episode raises broader questions about the ability of independently operated payment services to keep pace with rapidly evolving AI‑driven vulnerability disclosures.