What Happened
The BTCPay Server vulnerability warning is simple: the maintainer of BTCPay Server, an open-source cryptocurrency payment processor, has urged users to install the latest version. BleepingComputer reports that hackers have been draining hot wallets on instances running older versions.
A hot wallet is a cryptocurrency wallet that is connected to the internet. That makes it convenient for processing payments, but it also means the private keys are on a system that an attacker can try to reach. For an MSP, this is the kind of issue that can hit a client's cash flow directly, because a drained wallet is gone and usually not recoverable.
Timeline
So far, only one dated event is public.
- November 2, 2026BleepingComputer publishes a report stating that the maintainer of BTCPay Server has urged users to update after hot wallet thefts on outdated instances.
Who Is Affected
The affected group is anyone running an older version of BTCPay Server. The maintainer's warning applies to instances running older versions, which means if you have not updated to the latest release, you are in scope.
For MSPs, the practical question is whether you or your clients operate BTCPay Server for payment processing. If you do, this is a high-severity issue because the threat is active and involves stolen funds.
Technical Details: BTCPay Server Vulnerability
The source for this incident is a BleepingComputer report from November 2, 2026. No CVE identifier has been published for this issue.
Product: BTCPay Server, an open-source cryptocurrency payment processor. Affected versions: older versions. The maintainer has not specified a minimum affected version, only that instances running older versions have been targeted. Attack vector: the source does not detail how the attackers are gaining access, beyond stating that hot wallets on older instances are being drained.
The recommended fix is to install the latest version of BTCPay Server.
Why This Matters for MSPs
You may not think of BTCPay Server as an MSP problem, but it is a payment system. If a client runs it, a drained wallet is a direct financial loss and a reputational problem. The software is self-hosted, so there is no vendor cloud team watching the infrastructure. That makes version hygiene and monitoring your responsibility.
In general, any self-hosted payment processor needs the same discipline as other critical systems: track the version you run, watch for security announcements, and update on a schedule. This incident is a reminder that outdated instances are not just a compliance issue. They can be actively targeted.
What to Do This Week
Start with the action the maintainer gave: install the latest version of BTCPay Server. Then work through the rest of this list.
- Install the latest version of BTCPay Server on any instance you manage, including client instances.
- Check which version each instance is running before you update, so you can confirm the update happened.
- Review who has access to the server and to the wallet credentials. Remove anything you do not recognize.
- If you see any unauthorized transactions, rotate the wallet keys and move remaining funds to a cold wallet as a precaution.
- Turn on monitoring and alerts for outgoing transactions so a drain is visible quickly.
- Make sure backups of wallet data are stored offline and are restorable.
What to Tell Clients
BTCPay Server's maintainer has warned that hackers are draining hot wallets on outdated instances. If you use BTCPay Server, update to the latest version this week.
Check which version you are running and confirm the update. Review your wallet and server access logs for anything unusual. If you spot unauthorized transactions, rotate your keys and move funds to a cold wallet.
We are handling this for you, and we will confirm when your instance is updated and monitored.
Frequently Asked Questions
What Is BTCPay Server?
BTCPay Server is an open-source cryptocurrency payment processor. It allows businesses to accept bitcoin and other cryptocurrencies directly, without a third-party payment provider. Because it is self-hosted, the operator is responsible for updates, backups, and security. That makes it a system an MSP should track like any other critical business application.
Why Are Hot Wallets Being Drained?
The maintainer of BTCPay Server has stated that hackers are draining hot wallets on instances running older versions. The specific method has not been published. A hot wallet is connected to the internet by design, so if the software running it is outdated, the wallet is exposed to known and unknown attacks. Keeping the software current is the primary defense.
How Do I Know If My BTCPay Server Is Affected?
If you are running an older version of BTCPay Server, you are in the affected group. The maintainer has not published a list of vulnerable versions, so the only reliable way to know you are safe is to compare your installed version to the latest release and update if they differ. Check the version on every instance, including test and development systems.
What Should I Do If My Hot Wallet Was Drained?
Move any remaining funds to a cold wallet first, then rotate wallet keys and review server access logs. Update BTCPay Server to the latest version before you do anything else with the instance. Treat the server as compromised and consider rebuilding it from a clean backup. Also check whether any other systems share credentials with the affected server.
Can MSPs Manage BTCPay Server for Clients?
Yes. An MSP can manage BTCPay Server the same way it manages other business software. That includes tracking versions, applying updates, monitoring logs, and securing wallet credentials. The key is to treat it as a critical financial system, because a compromise leads directly to loss of client funds.
Is BTCPay Server Safe to Use After Updating?
Updating to the latest version is the maintainer's recommended fix. No software is completely risk-free, but running a current version removes the known exposure that is driving these wallet thefts. After updating, continue to monitor wallet activity and apply future updates promptly.
Sources
- BTCPay Server warns of hot wallet thefts targeting outdated instancesBleepingcomputer · Reported
- BTCPay Server warns of hot wallet crypto thefts on outdated instancesBleepingcomputer · Reported