BTCPay Server Hack: Why Merchants Were Told to Go Offline Overnight
BTCPay Server Hack: Merchants Told to Pull the Plug Overnight
As of November 2, 2026, a BTCPay Server hack is pushing merchants who run their own checkout offline.
In an official post on X, published at 5:25 p.m. ET on November 1 (22:25 UTC), the project said it was receiving reports of hot wallets being swept by unauthorized attackers.
It asked operators to run ./btcpay-down.sh and wait for the investigation to finish.
What Does the BTCPay Server Security Alert for Operators Say?
The post is short. It names no cause, no loss figure and no count of affected installs, so no BTCPay Server funds stolen total exists yet.
It also asks operators to keep each instance offline until the team finishes its work. Because the software is self-hosted, the instruction falls on each individual owner rather than on a central company.
BTCPay Server Hack News Today: What Is Confirmed?
Time (UTC) | Update | Source |
Oct 29 | Release 2.4.7 fixes 85 security findings | GitHub release notes |
Nov 1, 22:25 | Sweep reports, shutdown advised | Official X post |
Nov 1, 23:23 | Alert shared widely | SolanaFloor |
Nov 1, 23:40 | Cause pending, no patch yet | CryptosR_Us |
SolanaFloor also covered this news in its tweet on X, repeating that the team is investigating. 
CryptosR_Us also covered this news in its tweet on X, adding that the cause was still open and that it saw no patch yet. 
Is BTCPay Server Safe to Use Right Now?
The BTCPay Server hack news has no all-clear yet. Founder Nicolas Dorier later said affected cases appear to involve releases older than 2.4.2, and that an attacker had logged in as an administrator. He said the public instances on 2.4.7 were not attacked.
Is There a Security Flaw Behind the Reports?
Release 2.4.7 arrived on October 29 and fixed 85 security findings, including one critical and 13 high-severity issues, per the GitHub release notes.
The team has not tied that update to the BTCPay Server hack, and no confirmed BTCPay Server vulnerability explains them yet.
How to Shut Down BTCPay Server and Stay Safe?
For anyone searching BTCPay Server attack what to do, the steps are short:
Run ./btcpay-down.sh on the host machine.
Keep every instance offline until the all-clear.
Follow official channels for the BTCPay investigation.
Expert View: What Could This Mean for Merchants?
Analysts following crypto news may read the episode as a lesson in shared risk. A hot wallet keeps its signing seed on an internet-connected machine, which lets a self-hosted Bitcoin payment processor pay out automatically, and also widens exposure.
If unauthorized access came through stolen admin rights, merchant funds at risk could extend beyond the first reports.
Bitcoin hot wallet security is now the open question for any Bitcoin payment gateway run in-house.
In crypto news today, the next signal is the cause, and BTCPay Server news today will likely turn on it.
Merchants who ignore the request could face a BTCPay Server hot wallet attack and a BTCPay Server hot wallets drained scenario, though no source has quantified that risk.
A BTCPay Server unauthorized hot wallet sweep is still unverified at scale, and BTCPay Server shut down now remains the official advice.
Disclaimer: This article is for information only and is not financial, legal, or investment advice. Crypto assets are volatile, and you can lose money. Verify details with official sources before making any decision.
