BTCPay Server urges shutdown after reports of unauthorized hot-wallet sweeps
BTCPay Server says it is receiving reports of unauthorized hot-wallet sweeps and asks operators to shut down their instances while it investigates. The alert identifies no affected versions, attack vector, loss total or verified fix.
- Disclosed
- Nov 1, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Operators of BTCPay Server instances; the official warning does not narrow affected versions or configurations
- crypto
- In the wild
- Yes
- The project reports receiving unauthorized hot-wallet sweep reports; scope is unconfirmed.
What happened
The project’s November 1 warning is an actionable containment request for operators of a self-hosted payment system. Reports of actual wallet sweeps support L4, while the investigation remains preliminary. The alert does not establish how many instances were affected, how much was taken, whether every hot wallet is exposed, or whether the entry point is software, credentials or a deployment component.
Do not infer that cold wallets, every Lightning deployment or the Bitcoin network were compromised. No vulnerability identifier or release is tied to this warning. The project’s earlier security releases should not be treated as a confirmed remedy for these new reports without an explicit follow-up.
Crime-scene timeline
Nov 1, 2026
Project warns of hot-wallet sweeps and requests shutdown
The official alert asks instance operators to run ./btcpay-down.sh until the investigation is complete; no patch or restart time is given.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- BTCPay Server original emergency alertPrimaryThe project reports unauthorized hot-wallet sweep reports and asks operators to shut down while it investigates; the original HTML is blocked, but its complete official public embed is readable.
- Official public embed of the BTCPay Server alertPrimary
- BTCPay Server Docker operations documentationPrimaryDocuments the shutdown wrapper and container lifecycle; operational documentation is not an incident-specific fix.