BTCPay Server published an incident notice on November 2, 2026 following reports of bitcoin and litecoin stolen from hot wallets. The project’s investigation points to version 2.4.1 and earlier. Merchants hosting their own payments need to check the version running at the warning, rather than only the version displayed today.
Spending keys held online
A hot wallet keeps keys that authorize spending on the server. BTCPay says attackers used a different method to exploit the issue fixed in 2.4.2. BleepingComputer distinguishes this incident from the recent 2.4.7 release: installing the latest software and addressing past exposure are complementary decisions.
Attribute the estimated loss figure
Bitquery estimates approximately $1.63 million in transactions it links to the operation, valued using its November 2 reference prices. That independent analysis is not a total confirmed by BTCPay. The project warns that published address histories do not establish all losses attributable to this incident. Transaction counts should not be treated as merchant counts.
Check history before resuming
Find update dates in administration records or ask the hosting provider. The supplier’s recovery guidance also covers operators who updated after the November 1 warning. An absence of noticed withdrawals does not establish that secrets on an old server remained confidential.
Rebuild and separate spending keys
Follow BTCPay’s procedure for moving to a fresh server with a new wallet and seed. Do not enter replacement secrets on the old system. The Hacker News places off-server key custody in context: it limits what server access alone can spend. Document restoration with your administrator and share only public transaction references when reporting losses.
How Soclyde relates
BTCPay recovery also involves locating and replacing hosting and administration credentials. Soclyde organizes those records in an encrypted vault on team devices and supports authorized sharing. It does not replace a payment wallet or BTCPay’s server recovery procedure.
What to remember
For an old BTCPay server within scope, a recent version alone does not close the incident. Check history, follow migration guidance and separate spending keys where that fits your operations. To organize the professional accounts needed during recovery, contact Soclyde.
