BTCPay Server Tells Operators to Shut Down After Attackers Drain Bitcoin Hot Wallets

BTCPay Server, the open-source software that lets merchants accept Bitcoin without handing a cut to a third-party processor, told every operator running an instance to switch it off on the evening of November 1, 2026, after it began receiving reports that hot wallets were being drained by unauthorized attackers. The alert, posted to the project’s official X account at 5:25 p.m. ET on November 1, 2026, marks the first time the project has told its entire self-hosted user base to take servers offline since an August incident involving leaked Lightning credentials.