Hot Bitcoin wallets on self-hosted BTCPay Server instances were drained in multiple cases overnight on Nov 1-2, 2026.

Hot Bitcoin wallets on self-hosted BTCPay Server instances were drained in multiple cases overnight on Nov 1-2, 2026.

Telegram channels relaying Lookonchain reported hackers emptying hot wallets and urging anyone running BTCPay Server to shut servers down immediately, also repeated here and here.

Developers are cited as urgently urging shutdowns, with early investigation pointing to a vulnerability in old versions before 2.4.2, per AGGREGATOR.

No original BTCPay Server post, amount stolen, or attacker addresses were available in the sources read. X reads failed, and global Telegram search returned nothing further.

Context: BTCPay Server had just shipped v2.4.7 on Oct 29 fixing 85 security findings reported via Anthropic's OSS Scanner program, including 1 critical and 13 high, and urging updates especially for shared servers.

The sources do not name drained amounts or the exact vulnerable code.