What Happened: BTCPay Server Hot Wallet Theft
If a client runs an outdated BTCPay Server, you could be looking at drained cryptocurrency funds, an expensive incident response, and a client who no longer trusts you. The BTCPay Server hot wallet theft warning is direct: outdated instances are being drained. BleepingComputer reports that the maintainer of BTCPay Server, an open-source cryptocurrency payment processor, has urged users to install the latest version because hackers have been draining hot wallets on instances running older versions.
For an MSP, the financial exposure goes beyond the stolen coins. You may need to spend hours investigating how the attack happened, restoring service, and explaining the situation to the client. Cryptocurrency transactions are final. Once funds leave a hot wallet, there is no chargeback and no bank to call. That makes prevention and rapid recovery critical. The longer an outdated instance stays online, the greater the chance that a client's funds are next.
The immediate action is to update. The maintainer has not published a CVE or detailed technical explanation yet, but that does not change the urgency. If you manage BTCPay Server for any client, treat this as a 'patch now' event. Do not wait for a formal advisory to land in your inbox.
Timeline
The following timeline reflects the only dated event published so far.
- 2026-11-02: BleepingComputer publishes a report that the maintainer of BTCPay Server has warned users about hot wallet thefts targeting outdated instances.
Who Is Affected
According to the warning, BTCPay Server instances running older versions are affected. The maintainer did not name specific versions, so the only safe assumption is that any version that is not the latest is exposed.
Organizations that run BTCPay Server to process cryptocurrency payments should assume they are at risk until they update. That includes merchants, online services, and any business that accepts Bitcoin or other cryptocurrencies through BTCPay Server. BTCPay Server is popular among businesses that want to accept crypto without relying on a third-party processor.
For MSPs, the impact is indirect but real. If you host, maintain, or support a BTCPay Server instance for a client, you are responsible for its security posture. A compromise on your watch can cost you the client and your reputation. You also face the practical problem of explaining to a client why their funds are gone and what you are doing about it.
Why Hot Wallets Are a Target
A hot wallet is a cryptocurrency wallet connected to the internet. It is used to process payments automatically, so funds in it are accessible to software and, potentially, to attackers. Cold storage, by contrast, keeps funds offline and out of reach of remote attackers.
Payment processors keep some funds in hot wallets to enable fast transactions. The trade-off is that any vulnerability in the payment software can expose those funds. That is why keeping payment software up to date is a core security practice for any business that handles cryptocurrency. Attackers actively scan for outdated payment servers because they know these systems hold live funds.
For an MSP, the lesson is general: any internet-facing system that holds or moves value is a high-value target. Payment systems deserve extra scrutiny, faster patching, and continuous monitoring. The same principle applies to other payment platforms, not just BTCPay Server.
Technical Details
BleepingComputer reports that the maintainer of BTCPay Server has urged users to install the latest version. No CVE has been published for this issue. The product is BTCPay Server, an open-source cryptocurrency payment processor. The affected versions are described only as 'older versions.' The attack vector is hackers draining hot wallets on instances running older versions. The maintainer has not disclosed further technical details.
Without a CVE or version list, the technical details are limited. The key takeaway is that the maintainer is treating this as an active threat and is telling every user to update.
What MSPs Should Do
If you or your clients run BTCPay Server, treat this as an urgent patching event. Work through these steps in order.
- Update BTCPay Server to the latest version on every instance you manage. Verify the update is applied by checking the version reported by the server.
- Identify all BTCPay Server instances in your client base. If you do not have an accurate inventory, build one now, including the version each instance runs.
- Review hot wallet balances. Move any funds that are not needed for immediate operations to cold storage.
- Check for signs of unauthorized transactions on each instance. Look at transaction history and wallet addresses for outgoing transfers you did not initiate.
- Rotate API keys and credentials that may have been exposed. Do this after updating, so you are not rotating while still on a vulnerable version.
- Enable alerts for outgoing transactions so you are notified of unusual activity. Configure alerts to go to a mailbox or channel that someone monitors.
- Add a standing practice to apply security updates to payment infrastructure promptly. This incident is a reminder that payment software should be patched quickly.
How EnterProtect Helps
EnterProtect backup keeps clean restorable copies of systems and data. If a client's BTCPay Server instance is compromised, recovery can help get the client running again from a known-good backup.
EnterProtect vulnerability scanning helps you maintain an inventory of software versions across your clients, so you can plan and apply patches. These are general capabilities. They do not replace the need to update BTCPay Server, but they reduce the damage and speed up recovery.
With a clean backup, you can restore the payment server to a state before the compromise, which can be faster than rebuilding from scratch. And by keeping an accurate inventory of versions, you can spot outdated software before it becomes a problem.
Frequently Asked Questions
Is BTCPay Server Being Actively Exploited Right Now?
According to BleepingComputer, the maintainer of BTCPay Server says hackers have been draining hot wallets on instances running older versions. The maintainer has urged users to install the latest version. Treat this as an active threat, especially if you run an outdated instance.
What Versions of BTCPay Server Are Affected?
The maintainer has not named specific versions. The warning describes the affected systems as instances running older versions. The only safe conclusion is that any version that is not the latest should be considered vulnerable.
How Can I Tell If My BTCPay Server Instance Has Been Compromised?
Review your transaction history and wallet addresses for outgoing transfers you did not initiate. Check for unusual API activity and review server logs. If you see unauthorized transactions, assume the instance is compromised and take it offline.
What Should I Do If a Client's BTCPay Server Hot Wallet Has Been Drained?
First, take the server offline to prevent further loss. Then notify the client and preserve logs for investigation. Restore from a clean backup after you have updated to the latest version. Consider moving remaining funds to cold storage.
Does Updating BTCPay Server Guarantee My Funds Are Safe?
No update can guarantee safety, but the maintainer has urged users to install the latest version, which suggests the current release addresses the issue. Continue to follow security best practices, including monitoring transactions and keeping hot wallet balances low.
How Should MSPs Handle Clients Who Use BTCPay Server?
Treat BTCPay Server as critical payment infrastructure. Update it promptly, maintain an inventory of instances, monitor for unauthorized transactions, and have a recovery plan in place. General patching and monitoring practices apply.
Sources
- BTCPay Server warns of hot wallet thefts targeting outdated instances (Bleepingcomputer)