Protocols & Policy · Wallets
The open-source payment software said it had reports of attackers emptying hot wallets on some servers and asked everyone running it to switch off until its investigation ends.
BTCPay Server, software that merchants use to accept bitcoin, told everyone running it to shut it down on Sunday after reports that attackers were emptying hot wallets connected to some of those servers [1].
"We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers," the project said in a post on X at 5:25 p.m. ET. "If you're running an instance, please shut it down (./btcpay-down.sh) until we complete the investigation" [1].
BTCPay Server is a self-hosted payment processor, meaning each shop runs its own copy on its own machine rather than paying a company to handle payments. There is no central operator holding customer funds, which is the point of the software, and also why the warning had to go to every operator at once.
A hot wallet is one whose signing keys sit on an internet-connected machine, so it can send coins without a person approving each payment. On BTCPay, that lets a store pay refunds or move funds automatically. It also means that whoever controls the server can move the coins. Stores that only receive payments into a wallet whose keys are kept elsewhere are set up differently, but BTCPay's warning asked anyone running an instance to shut it down [1].
When Le Coin rechecked BTCPay's own channels at 9:07 p.m. ET, the project had not published a blog post or a security advisory on GitHub about the reports [2][3][4]. BTCPay has not said how many servers were affected or how much bitcoin was taken. Its X account had said nothing further in its own words [2].
| Time (ET, Nov. 1) | Event | Figure |
|---|---|---|
| 5:25 p.m. | BTCPay posts shutdown warning [1] | |
| 9:07 p.m. | Bitcoin price, CoinGecko [5] | $78,324 |
| 9:07 p.m. | Bitcoin 24-hour change, CoinGecko [5] | +0.80% |
Sources: BTCPay Server post on X; CoinGecko API, 9:07 p.m. ET Nov. 1, 2026. Powered by CoinGecko API. No link is drawn between the reports and the price.
A shutdown warning on a Sunday evening, based on reports rather than a published finding, could be read as caution running ahead of evidence. Not every server holds a hot wallet. BTCPay's request covered all of them anyway, and it has not said what it found.
Self-hosting removes the company in the middle. It also removes the company that would otherwise push a fix to every server at once. BTCPay's only lever tonight was a post asking operators to act, and the next one will be whatever it publishes on its own channels. That is the document to wait for.
The facts so far are BTCPay's warning and its instruction to shut down. The next step will come from BTCPay's own X account, blog or GitHub, not from reposts.
Holding the Corner.
Not financial advice.