BTCPay Server Exploit Drains 1.63 Million USD From Merchant Hot Wallets

Hackers have drained an estimated 1.63 million USD in cryptocurrency from unpatched merchant stores running BTCPay Server, exploiting administrative vulnerabilities to empty automated checkout wallets across hundreds of self-hosted payment nodes.

By Marcus Reid | November 4, 2026

The cryptocurrency market is currently navigating cautious terrain. Bitcoin trades at 80,158 USD, while broader market sentiment sits at a fearful 34 on the Crypto Fear & Greed Index. When broader market conditions turn cautious, infrastructure vulnerabilities often exact an even heavier toll on small businesses and independent merchants. Over the past several days, an automated wave of attacks hit store owners who process their own customer payments, turning automated online checkout machines into digital cash registers emptied by remote thieves.

The Incident

Between October 30 and November 2, 2026, attackers executed a coordinated sweep against dozens of online merchants using BTCPay Server, the widely used open-source software that allows online shops to accept digital currencies without paying middlemen or transaction fees. Unlike centralized payment gateways that hold funds on behalf of a store, BTCPay Server lets merchants act as their own payment processor. However, that sovereign control also means server maintenance falls squarely on the merchant’s shoulders.

According to emergency advisories released by project founder Nicolas Dorier and the core development group on November 1, 2026, attackers systematically targeted self-hosted instances running version 2.4.1 (released July 23, 2026) or earlier. By exploiting an administrative access bypass, the intruders gained unauthorized control of unpatched servers and instructed the software to sweep balances directly out of the connected checkout wallets.

Blockchain tracking records confirm the broad reach of the campaign:

• Total estimated losses — 1.63 million USD in combined Bitcoin and Litecoin balances stolen directly from merchant hot wallets.
• Attack scope — Over 682 separate automated transfer sweeps tracked across hundreds of independent merchant nodes.
• Vulnerable software — Instances operating on BTCPay Server v2.4.1 or older, which left administrative pathways exposed.
• Patched release — Version 2.4.7, which patched underlying remote flaws and eliminated the administrative bypass vector.

Following the Money

The theft unfolded through automated scripts designed to siphon funds in rapid succession. Rather than draining each compromised storefront manually, the attacker deployed an automated script that queried each vulnerable server, collected its active balance, and executed a broadcast transaction funneling the coins into central consolidation wallets.

The attacker directed the stolen proceeds into two primary destination addresses identified by security researchers and the BTCPay development team:

• Bitcoin consolidation address — bc1p0f7wmcnesrapznymf9ljdn04pudgmh96sqtrm9vmgqxdh666fh8qvn63r7
• Litecoin consolidation address — ltc1qp49tmfdueyaqrmgrx0uyx4uegyygt8yt02whee

I traced the attacker’s primary Bitcoin consolidation address through public records: the automated sweeps stopped at that single wallet, with no further bridge hops or exchange deposits recorded yet. That pattern indicates the thief has opted to let the funds sit motionless in primary Taproot addresses rather than attempting an immediate exit through cross-chain protocols or centralized off-ramps that are already monitoring the flagged clusters.

To picture how this attack worked in practice, imagine an automated checkout lane at a grocery store. When a customer inserts cash, the register drops the bills into an internal drawer. The attacker did not steal the money by breaking through the store’s physical front door. Instead, they tapped into the automated cash register’s software controls from across the internet, pressed the payout button remotely, and directed the register to dump the contents into their own satchel.

The Weak Point

The core vulnerability stems from how automated payment processors handle digital currency. To generate invoices, verify incoming customer transactions, and automatically issue refunds, an online store requires a hot wallet. A hot wallet is a digital wallet connected directly to the internet, with its private signing keys stored directly in the server’s working memory.

In contrast to a cold wallet—which acts like a steel bank vault disconnected from any network—a hot wallet is like leaving cash in a shop register on the sales counter. It needs to stay accessible so the cashier can make change instantly. But if the software running that register has an unpatched flaw, anyone who finds the backdoor can open the drawer without a physical key.

In this incident, machines operating on version 2.4.1 or older suffered from an authentication loophole that allowed outsiders to achieve administrative access. Once an intruder logged in as an administrator, they could access the internal signing keys that the server used to process refunds and settle accounts. At that stage, the blockchain cryptography did not fail; the cryptography worked exactly as designed. The software simply accepted an unauthorized command from a compromised administrative account.

Crucially, the development team warned that simply clicking “update” on an already-compromised machine is not enough. If an attacker achieved administrative access before the update was applied, they may have copied the wallet’s recovery phrase or installed hidden backdoors. Updating the software after the fact is like installing a deadbolt on your front door after a burglar has already made a duplicate key.

How the Industry Responded

The BTCPay Server core team moved quickly once the wave of drained wallets came to light. On November 1, 2026, maintainers issued an urgent emergency advisory instructing server administrators running outdated instances to shut down their software immediately using the ./btcpay-down.sh script.

Project maintainers made an important distinction: public and managed instances already running version 2.4.7 were unaffected. The exploit succeeded exclusively against self-hosted nodes where individual shop owners had neglected software updates over the summer and autumn. Because BTCPay Server is decentralized, developers cannot remotely force updates onto independent merchant servers. Node operators must apply updates themselves.

For merchants who discovered they were running vulnerable builds, the project issued strict recovery guidelines:

• Decommission the old server — Treat the entire machine and operating system as permanently compromised.
• Spin up clean infrastructure — Rebuild the node on a brand-new, isolated virtual private server.
• Generate a new seed phrase — Never reuse the previous wallet keys or recovery phrases.
• Sweep remaining balances — Transfer any remaining funds from the old addresses to a secure off-server destination before bringing the new storefront online.

Simultaneously, blockchain tracking platforms such as Bitquery cataloged the 682 sweep transactions and applied risk flags to both primary attacker addresses. Major centralized exchanges and compliance partners have blacklisted the addresses to stop the perpetrator from cashing out into fiat currency.

Lessons for Your Wallet

While this exploit primarily hit business owners rather than individual shoppers, the incident offers vital protective lessons for anyone holding or transacting with cryptocurrency:

• Understand the hot wallet limit — Never store your primary savings in a wallet connected to the internet. Hot wallets are strictly for daily operating expenses. Whether you run a storefront or manage personal funds, keep the vast majority of your holdings in cold storage on a hardware device.
• Shopper safety remains intact — If you recently purchased items using Bitcoin at an online store running BTCPay Server, your personal wallet was never at risk. The attacker drained the merchant’s incoming register, not the buyer’s private keys. However, customer refunds could face delays if a vendor lost their operational funds.
• Implement automatic payout sweeps — If you accept crypto payments for goods or services, configure your checkout system to forward incoming payments automatically to an offline cold storage address once balances hit a modest threshold. That way, even if a server is breached, the attacker only finds pocket change.
• Software updates are security shields — In decentralized finance and sovereign computing, there is no technical support desk to restore stolen funds. If you host your own node, wallet, or payment stack, updating software the day a patch arrives is mandatory.

Marcus Reid’s take

Self-hosting is only as sovereign as your patch schedule; leaving an active signing key on an unmaintained public server turns an independent merchant into an easy mark. I will watch the 1.63 million USD sitting in the attacker’s primary address to see whether it enters mixers or gets blacklisted by major off-ramps. If merchant operators start adopting hardware-isolated signers instead of raw server seeds, this attack vector will finally die.

The cryptocurrency market remains highly volatile. This article is for informational purposes only and does not constitute financial advice.