BTCPay Server Urges Shutdowns Following Wallet Drain Reports

The project’s incident response team narrowed the vulnerability to software versions 2.4.1 and older, released on or before July 23, 2026. While the investigation remains ongoing, co-founder Nicolas Dorier confirmed that attackers successfully obtained administrator privileges on compromised instances. The exact mechanism used to bypass security remains under review, though the latest version, 2.4.7, currently shows no credible signs of exploitation.

In response to the threat, several hosting providers, including LunaNode, have proactively suspended older instances to prevent further losses. BTCPay Server has not disclosed the total financial impact or the number of servers affected by the breach. Affected operators are instructed to use the ./btcpay-down.sh script to secure their systems and forward relevant server logs to the project’s security team for analysis. Users are strongly advised to keep their software updated and transition funds from online hot wallets to cold storage to mitigate future risks.