BTCPay Server hot wallets (October–November 2026) hack — October 2026
Incident facts
| Date of incident | |
|---|---|
| Publicly disclosed | November 1, 2026 |
| Target type | Wallet software or provider |
| Loss | $1,628,450Price at time of incident |
| Method | Other or undisclosedAn attacker logged in as administrator on self-hosted BTCPay Server instances running version 2.4.1 or older and swept their hot wallets; how the admin access was obtained has not been published |
| Chains | Bitcoin, Other |
| Outcome | Unresolved |
What happened
BTCPay Server, free software that merchants run on their own servers to accept bitcoin, warned at 22:25 UTC on 1 November 2026 that hot wallets on BTCPay instances were being swept by unauthorised attackers, and told operators to shut their servers down. Its lead developer Nicolas Dorier said the attacker had managed to log in as an administrator on the affected instances. On 2 November the project said its investigation had found an attack vector affecting version 2.4.1, released on 23 July 2026, and older, and that it had no credible reports of drains on the current 2.4.7. Some hosting providers shut older instances down automatically.
Bitquery traced $1,628,450 at 2 November prices to the two collecting addresses BTCPay named: 18.38 BTC and 3,405 LTC taken in 682 sweeps between 30 October and 2 November. 87% moved in one wave between 14:12 and 22:16 UTC on 1 November, 62 hours after the first sweep it could see, and 267 sweeps worth about $150,000 landed after the alert. At 06:00 UTC on 2 November more than 99% still sat in addresses first used in the theft.
The losses fell on the merchants running those servers. BTCPay has promised a blog post with more detail and asked those affected to send logs to its security team.
Sources
- BTCPay Server on X (1 November 2026)Primary · retrieved 2026-11-02
- BTCPay Server on X: versions 2.4.1 and older (2 November 2026)Primary · retrieved 2026-11-02
- Nicolas Dorier on X (2 November 2026)Primary · retrieved 2026-11-02
- Bitquery investigation (2 November 2026)Secondary · retrieved 2026-11-02
Changes to this entry
- Recorded at Bitquery’s count, valued at 2 November prices; BTCPay has published no total. Revisit when its blog post names the vector.
Cite this
This data is published under CC BY 4.0. You may reuse it, including commercially, as long as you credit iTokenly and link back.
iTokenly Hack Registry, "BTCPay Server hot wallets (October–November 2026) hack — October 2026", iTokenly, accessed 2026-11-02, https://itokenly.com/hacks/btcpay-server-hot-wallets-november-2026https://itokenly.com/hacks/btcpay-server-hot-wallets-november-2026Permalinks never change. If an entry is renamed, the old address keeps working.
Spotted an error? Write to [email protected]. Corrections to published figures are logged on this page. See the methodology for how entries are checked.