Hacking News
BTCPay Server warns of hot wallet theft affecting pre‑2.4.2 installations
BTCPay Server issued an emergency shutdown warning on Nov. 1, 2026 after reports that attackers were draining bitcoin from hot wallets linked to self‑hosted payment servers. Founder Nicolas Dorier said the compromises affected deployments running versions earlier than 2.4.2, while servers running version 2.4.7 had not been attacked. Operators were instructed to shut down their instances using the ./btcpay-down.sh command until the cause was determined. The incident follows a recent AI‑assisted security update that fixed 85 vulnerabilities, including a critical one, released on Oct. 29, 2026. At the time of reporting, developers had not disclosed the total amount of bitcoin stolen or the number of affected merchants.