BTCPay Server Hot Wallet Attack 2026: What Merchants Must Do Now

BTCPay Server told merchants to shut down after hot wallets were drained on versions 2.4.1 and older. What happened, what to fix today, and the crypto payment rules in the UAE and Pakistan.

3 November 2026 · Deixtra

Last updated 3 November 2026. This is a developing story. BTCPay Server has not published a full post-mortem, a loss figure or a count of affected servers, and details may change.

On Sunday, 1 November 2026, the team behind BTCPay Server, the free, self-hosted bitcoin payment processor, told operators to switch their servers off. Merchants had reported that the hot wallets connected to their BTCPay instances were being emptied. The project then narrowed it down: the attack targeted instances running version 2.4.1 (released 23 July 2026) or older, and there were no credible reports of drains on the current 2.4.7 release. Founder Nicolas Dorier said the attacker had logged in as an administrator on the affected servers, and the team was still working out how.

This is the second serious BTCPay incident in three months, after an actively exploited flaw was patched in August. If your store in Pakistan, the UAE or Saudi Arabia has a "pay with bitcoin" button running through BTCPay, WooCommerce or Shopify, this affects you. We build e-commerce stores, POS and payment integrations, and the question we hear most from merchants who take crypto is simple: is my money safe on the server, and what do I do today? This post answers that and explains where merchant crypto payments stand legally in the UAE and Pakistan. Sources are at the end.

What happened to BTCPay Server in November 2026?

Attackers gained administrator access to self-hosted BTCPay Server instances running version 2.4.1 or older and swept funds out of the hot wallets attached to them. BTCPay first told every operator to shut down, then said the latest 2.4.7 release showed no credible drains. The root cause is not confirmed yet.

Here is the sequence as reported by BleepingComputer, CoinDesk, Decrypt and BTCPay's own posts:

On 1 November, BTCPay asked operators to stop their servers (with ./btcpay-down.sh) while it investigated unauthorised withdrawals. Some outlets date the warning to 2 November.
LunaNode and other hosting providers automatically shut down customer instances running older versions, and BTCPay thanked them publicly.
BTCPay's incident response identified "an attack vector targeting instances running versions 2.4.1 (Jul 23, 2026) or older."
Dorier said the attacker logged in with admin privileges and that public servers were not attacked. CryptoPotato reports he also mentioned traces of pre-2.4.2 vulnerabilities being used, which no official write-up has confirmed yet.
BleepingComputer reported that the unauthorised transfers involved bitcoin and litecoin.
Affected merchants were asked to email security@btcpayserver.org and report losses to local police.

Nobody has published a total loss figure, the number of affected stores, or how the attacker became admin. Any number you see on social media right now is a guess.

What is BTCPay Server and who uses it?

BTCPay Server is open-source software that lets a business accept bitcoin without a middleman. The merchant runs the server, holds the keys and pays no processing fee to BTCPay. Online stores connect to it through plugins for WooCommerce, Shopify and other platforms.

That self-hosted model is the point: nobody in the middle can freeze payments or take a cut. It is also why this incident is messy. The developers cannot push a fix or switch servers off remotely, so every merchant or host has to act. A store owner who had a freelancer set up BTCPay two years ago and never logged in again is exactly the operator likely to still be on an old version.

What is a hot wallet in BTCPay, and why was it the target?

A hot wallet in BTCPay is a wallet whose private key (the seed) is stored on the server, so the server can sign and send transactions without a person approving them. Anyone with admin access to that server can move the money. A watch-only wallet keeps the keys off the server entirely.

When you create a wallet in BTCPay, it shows a 12-word seed once. With the hot wallet option off, the seed is wiped and BTCPay keeps only the public key (the xpub), which it uses to create a fresh address for each invoice. With the option on, the seed stays on the server. That is handy for refunds, payouts and Lightning, but it turns the server into a vault with the key taped to the door. BTCPay's own documentation warns about storing private keys on a public server.

Setup	Where the private key lives	What an attacker with admin access can do	Typical use
Hot wallet (seed on server)	On the BTCPay server	Sign and send funds out of the wallet	Refunds, payouts, Lightning, automated sweeps
Watch-only wallet (xpub only)	On a hardware wallet you control	See balances and change settings, but not sign a spend	Receiving customer payments
Hardware wallet signing (PSBT)	On a hardware wallet, connected only to approve a spend	Prepare a transaction that still needs your device to sign	Occasional refunds or supplier payments

The lesson is old advice many merchants skipped: keep only a small float in any hot wallet, and send the rest to a wallet whose keys BTCPay has never held.

Which BTCPay versions are affected?

BTCPay says the November attack targets version 2.4.1 and older. The current release is 2.4.7, published on 29 October 2026, and the project reports no credible hot wallet drains on it. If your server footer shows anything below 2.4.7, update before switching it back on.

The 2.4.x line has had several security releases this year, according to the official release notes on GitHub:

Version	Release date	Security notes
2.4.1	23 Jul 2026	No security section. Targeted by the November attack, along with older versions.
2.4.2	7 Aug 2026	Fixes a critical vulnerability "being actively exploited" and a two-factor bypass.
2.4.3	24 Aug 2026	Labelled a security release.
2.4.5	6 Oct 2026	Blocks requests to private networks by default.
2.4.6	26 Oct 2026	Hardening of API permissions, redirects and logout, plus a .NET update.
2.4.7	29 Oct 2026	Fixes 85 findings from a code-scanning report (1 critical, 13 high, 52 medium, 19 low).

The critical August fix had been available for almost three months, and the attack hit servers that never installed it. The 2.4.7 notes also say updating is "highly recommended, especially for servers shared by multiple merchants", so if your host runs many stores on one server, ask which version you are on.

How was the August 2026 BTCPay exploit different?

The August incident hit Lightning users. Reports say a flaw in versions before 2.4.2 let an outside attacker grab LND "macaroon" credential files, which control a Lightning node, and drain channels. The November attack involves admin logins and on-chain hot wallets. BTCPay has not said whether the two are linked.

The Block reported that supporters offered a recovery bounty of 10% of recovered funds, capped at 3 BTC. BTCPay's advice then was to update, revoke Lightning credentials and move hot wallet funds to keys BTCPay had never seen, because updating does not cancel credentials already stolen. If you skipped those steps, do them now. As with the Binance hack in October, the weak point was access and key handling, not the blockchain.

Is it legal for a UAE business to accept crypto payments?

On the UAE mainland, mostly no, at least not in bitcoin. The Central Bank's Payment Token Services Regulation says a business selling goods or services in the UAE may not accept a virtual asset as payment unless it is a dirham payment token from a CBUAE-licensed issuer. DIFC and ADGM sit outside this rule.

Law firm summaries of Article 2(7) agree on the core point. A registered foreign stablecoin can be used only to buy virtual assets, and bitcoin or ether cannot pay for ordinary goods. The rule applies even to firms licensed by VARA or the SCA. Sources give slightly different effective dates in August 2024, so check the current position with your adviser. A Dubai mainland store running a BTCPay bitcoin checkout has a security problem and a regulatory one this week.

What about Pakistan and Saudi Arabia?

In Pakistan, crypto is regulated but not legal tender. The Virtual Assets Act 2026 created a PVARA licensing regime, but coverage up to October 2026 reports no full exchange licence yet, and no rule we found lets a shop settle sales in bitcoin. Saudi Arabia has no crypto payments framework in force.

PVARA notified licensing regulations in August 2026 covering about ten activity types, and existing providers had to apply for a no objection certificate by 5 September 2026 or stop operating. Secondary sources report penalties of up to PKR 50 million and five years in prison for unlicensed operation. A shop accepting bitcoin for its own sales is not obviously a "service provider", but that line is untested and the rupee is the only legal tender. We would not build a Pakistani checkout around direct crypto acceptance without written legal advice. In Saudi Arabia, secondary sources report no published SAMA or CMA crypto rulebook as of mid-2026. For local card and wallet options, see our guide to Shopify payment gateways in Pakistan.

What should merchants running BTCPay do right now?

Check your version, update to 2.4.7 and move funds out of any hot wallet before going live again. Then reset admin credentials and review who has access. If a host runs your server, ask whether they shut it down and which version it runs.

Read the version string in the BTCPay footer, or ask your host. Anything below 2.4.7 stays offline until updated.
Update through the admin area (Server Settings, Maintenance, Update) and confirm 2.4.7 appears in the footer.
Send any hot wallet balance to a fresh seed generated on a hardware wallet and never typed into BTCPay. Treat any seed that lived on an old server as exposed.
Reconnect the store with only the xpub, so the server can create addresses but cannot spend.
Remove unknown admin accounts, reset passwords, turn on two-factor login and regenerate API keys used by WooCommerce, Shopify or your POS.
If you use Lightning, revoke macaroons (LND) or runes (Core Lightning).
Compare invoices marked paid in your store with what actually reached your wallet.
If funds are missing, email security@btcpayserver.org and file a report with your local cybercrime authority.

Common mistakes we see with crypto checkouts

Most merchant crypto setups we review fail on maintenance, not on the blockchain. These patterns turn a software bug into a loss:

A freelancer enables the hot wallet "to make refunds easy", hands over a login and nobody updates the server for a year.
The whole balance sits in the hot wallet because nobody set up a sweep to cold storage.
Several stores share one server and one admin account.
The admin panel is open to the internet with no two-factor login.
Finance reconciles from the store's order screen, not the wallet, so a drain goes unnoticed for days.
Nobody checked whether accepting bitcoin was allowed, which on the UAE mainland it usually is not.

What to watch next: a formal BTCPay post-mortem, loss figures from affected merchants, and whether the August and November incidents share an entry point.

Key takeaways

BTCPay told operators to shut down on 1 November 2026 after hot wallets were drained on instances running 2.4.1 or older.
The attacker gained admin access. The root cause, loss total and victim count are not published.
BTCPay reports no credible drains on 2.4.7, released 29 October 2026.
Treat any seed stored on an old server as exposed and move to watch-only mode.
UAE mainland merchants generally cannot accept bitcoin for goods and services under CBUAE rules.
In Pakistan, crypto is regulated under PVARA but is not legal tender, and merchant acceptance is legally untested.

Frequently asked questions

Was BTCPay Server hacked?

Self-hosted instances on version 2.4.1 or older were attacked and some hot wallets were drained. There is no central BTCPay service, because each merchant runs their own server.

Is BTCPay Server 2.4.7 safe to use?

BTCPay says it has no credible reports of drains on 2.4.7. That is the project's statement during an open investigation, not an independent audit, so keep hot wallet balances small.

How do I check my BTCPay Server version?

The version number is in the footer of the admin dashboard. If a host manages your server, ask them, since some have already shut down older instances.

Does a watch-only wallet protect my bitcoin if the server is hacked?

It protects the funds, because the server holds no signing key. An attacker could still change settings such as the payout address, so review settings after any breach.

Can businesses in Dubai accept bitcoin as payment?

On the mainland, CBUAE rules bar merchants from accepting virtual assets for goods and services, except licensed dirham payment tokens. DIFC and ADGM are outside that rule.

Can a shop in Pakistan accept crypto payments in 2026?

Crypto is not legal tender in Pakistan, and PVARA licenses service providers, not shops. No rule we found authorises direct merchant acceptance, so take legal advice first.

Should I stop accepting crypto altogether?

That is a business and legal decision. If you continue, use watch-only wallets, keep software updated and confirm the activity is allowed where you operate.

Need help securing your checkout?

Deixtra builds and maintains e-commerce stores, Shopify apps, POS systems and payment integrations for businesses in Pakistan, the UAE and the GCC. We can audit a crypto or card checkout, set up update and monitoring routines, separate store access properly, and connect orders to inventory and accounting so payments reconcile daily. Send us your setup on WhatsApp and we'll come back with a written scope and a fixed quote.

Disclaimer: This post is general information about a developing security incident and the regulatory position as reported in public sources. It is not investment, legal or tax advice, and it does not recommend buying, selling or holding any crypto asset. Crypto assets are volatile and can be lost permanently. Speak to a licensed adviser before accepting or holding crypto in your business.