BTCPay, a bitcoin payment tool, tells users to switch off their servers after reports of drained wallets
BTCPay Server, an open-source bitcoin payment processing tool widely used by merchants and businesses, has issued an urgent advisory instructing users to shut down their self-hosted servers following multiple reports of wallets being drained. The warning was issued on November 2, 2026, as the team investigated what appears to be an active security vulnerability affecting its infrastructure.
BTCPay Server is a self-custodial payment solution that allows merchants to accept bitcoin without relying on third-party processors. It is used by thousands of businesses globally, ranging from small online retailers to larger commercial operations. Because users maintain control of their own private keys and server environments, a breach at the infrastructure level can directly expose funds held within connected wallets.
The incident raises significant concerns about the security risks associated with self-hosted financial software, particularly as bitcoin adoption among merchants continues to grow. If the vulnerability is confirmed to be widespread, it could undermine confidence in open-source payment tools and prompt businesses to reassess how they manage bitcoin payment infrastructure. Regulatory observers may also take note, given increasing scrutiny over the security standards of crypto-related software.
Users of BTCPay Server are advised to follow official guidance from the development team and monitor the project's official communication channels for updates. Security researchers are expected to release a fuller technical disclosure once the scope of the vulnerability has been determined and mitigations are in place.
Source: CoinDesk
