Skip to content
Centoculus

Security alert · Critical

BTCPay Server: attackers drain hot wallets on outdated self-hosted instances

· 3 minutes read · Centoculus Security Team

Known since · attacks confirmed since

Affected: Self-hosted BTCPay Server instances running older releases

What happened

On 2 November 2026 the maintainer of BTCPay Server warned that attackers are draining hot wallets on instances that run older releases. The maintainer urges all users to install the latest version. The warning is based on thefts that are already taking place, so this is active exploitation, not a theoretical risk.

The public report does not name a CVE, the affected release range or technical details of the attack. For exact version numbers and further guidance, check the maintainer's announcement and the report linked below.

Who is affected

  • Operators of self-hosted BTCPay Server instances that are not on the latest release.
  • Especially instances that use a hot wallet, meaning the private keys or seed are stored on the server so that it can send funds.
  • Agencies and hosters that run BTCPay Server for web shops of their customers, for example as a payment backend for a shop system.

Instances that only use a watch-only wallet (no private keys on the server) hold no spendable funds on the server itself, but should still be updated.

What to do now

  1. Find every BTCPay Server instance you or your customers operate and note the running version (shown in the footer of the web interface and in the server settings).
  2. Back up the configuration and data before updating. For Docker-based deployments this includes the environment settings and the data volumes.
  3. Update to the latest release. On the standard Docker deployment this is done from the server settings in the web interface or with the update script supplied with the deployment. Use the method documented for your installation.
  4. After the update, confirm that all containers or services are running, that the web interface loads and that the node is synced.
  5. Check the balance and transaction history of every hot wallet. If funds are missing or you see outgoing transactions you did not initiate, treat the server and the wallet seed as compromised.
  6. If a hot wallet may be compromised: stop using it, create a new wallet with a new seed on a trusted system, and move any remaining funds there. Do not reuse the old seed.
  7. If you do not need the server to send funds, consider switching stores to a watch-only wallet so that no private keys are kept on the server.
  8. Inform affected customers if their stores or funds are involved.

How to check whether you were hit

  • Compare the version of each instance with the latest release published by the maintainer. Any instance not on the latest version should be treated as at risk.
  • Review outgoing transactions from hot wallets, both in BTCPay Server and in a block explorer, for payments you cannot account for.
  • Review the list of users, especially administrators, and remove accounts you do not recognise.
  • Review API keys, connected apps and store settings for entries or changes nobody on your team made, and revoke anything unknown.
  • Check the server and reverse proxy logs for unusual logins or access from unknown IP addresses around and before 2 November 2026.

Sources

Related posts