BTCPay Server tells users to update after hot wallets drained on version 2.4.1 and older

BTCPay Server, the open-source software many shops use to accept bitcoin, has told operators to update after attackers drained funds from users' hot wallets. On Monday 2 November 2026 the project said its investigation had found an attack vector affecting version 2.4.1 or earlier, and that it had no credible reports of drains among users on the latest release, 2.4.7, Cointelegraph reported. Earlier, it had told operators to switch their servers off while it investigated, CoinDesk reported.

What we know

• Who is affected: operators running BTCPay Server 2.4.1 (released 23 July 2026) or older, with a hot wallet, meaning keys kept on the server so it can send funds automatically.
• What to do: update to 2.4.7. BTCPay has asked anyone hit to send details and logs to its security team.
• What is not known yet: how many operators lost money, how much was taken and exactly how the attackers got in. BTCPay has not said.
• Earlier trouble: in August BTCPay restricted remote Lightning access after an attack that stole LND (Lightning Network Daemon) credentials and funds. It is not clear whether the two are linked.

Who in Pakistan should care

BTCPay is self-hosted: a merchant or freelancer runs it on their own server rather than signing up with a company. Pakistani freelancers and small online sellers who take bitcoin from overseas clients through their own BTCPay install should check their version today. If you only hold bitcoin on an exchange or in a phone wallet, this does not touch you directly.

The basic lesson holds either way: keep only what you need for day-to-day payments in a hot wallet, and move the rest to cold storage you control.

The market: steadier after the Binance hack

The BTCPay news landed as the market was settling after the record Binance hack. Bitcoin was at about $78,013 on Monday on our bitcoin price page, roughly flat on Sunday. At the interbank rate of Rs 276.75 a dollar (USD to PKR), one bitcoin comes to about Rs 21.6 million. CoinDesk reported bitcoin clawing back toward $79,000 as traders shrugged off the hack, and Cointelegraph said Binance's net outflows reached $5.8 billion once withdrawals resumed. Our earlier story covers the Binance hack and the withdrawal pause.

Our currency converter turns any dollar amount into rupees at today's rate.