BTCPay asks operators to stop their servers while wallet drains are investigated.

BTCPay Server urged operators to shut down their instances after reports of unauthorised hot-wallet withdrawals. Reporting on 2 November says the investigation points to installations running 2.4.1 or older; the project reports no credible drains on the latest 2.4.7 release. The cause and total losses remain unconfirmed.

CoinDesk reports that founder Nicolas Dorier described attackers obtaining administrator access on affected servers, while saying the project was still establishing how. Its initial shutdown call was broad. The later version-specific statement reported by crypto.news narrows the suspected exposure but does not establish that every older installation was compromised or guarantee that newer software is immune.

BTCPay is self-hosted payment software, so individual operators manage their installations and wallet configuration. Its documentation warns that hot wallets keep signing keys on the server. Merchants should follow the project's current incident guidance and inspect their deployed version; this story does not replace that operational advice.

The official 2.4.7 release, published on 29 October, recommends updating and lists security, reliability and payment-accounting fixes. That release should not be presented as a proven explanation or complete remedy for this new investigation. An earlier August LND credential vulnerability is a separate documented incident; its findings cannot simply be carried over to these fresh reports.