For three days a thief emptied hot wallets on old BTCPay Servers. We traced $1.6M. Nearly all of it is still parked
Shops run BTCPay Server so that nobody else holds their money. On servers left without updates, that money sat one login away from a stranger. We followed the two addresses BTCPay named to count what left, and where it went.
- $1.63M
- 62 hours
- 87%
- 267
- 77%
- 99%+
01 · What happenedWhat happened in the BTCPay Server hack
On Sunday, 1 November, shops that take bitcoin on their own servers kept working as usual. Buyers paid. Orders were marked as paid. All afternoon, behind the checkout, the money was leaving.
These shops run BTCPay Server, free software that lets a business take bitcoin and other coins with no payment company in the middle. The business runs the server itself, and payments go straight to its own wallet. Some owners keep that wallet's keys on the server, a setup called a hot wallet. With the keys there, the server can send coins without anyone signing each payment by hand.
Some of those servers had gone months without an update. A thief signed in to them as an admin and sent all the coins in their hot wallets to two addresses, one on Bitcoin and one on Litecoin. BTCPay told everyone running the software to shut it down at 22:25 UTC that night. Its lead developer, Nicolas Dorier, posted both addresses early the next morning.
Bitquery reads every transaction on Bitcoin and Litecoin, so we followed those two addresses. We counted $1.63M taken in 682 separate sweeps, transfers that empty a wallet in one go. They ran over about three days, and most of the money went in one afternoon and evening. The thief has paid most of the bitcoin out to brand-new addresses, and almost none of it has moved again since then. We cannot tell how many servers were hit, because the chain records wallets and says nothing about the servers behind them. Each total here runs to 06:00 UTC on 2 November, and the count was still rising when we stopped.
02 · The softwareWhat BTCPay Server is, and what a hot wallet does
BTCPay Server is a free alternative to a bitcoin payment processor. Shops and charities run it so that no company holds their money, and it is open source. The owner runs it on a rented server or a machine at home. It watches the blockchain for payments to each invoice.
Each order gets a new address, so when a customer pays, the coins land there and stay until the owner moves them. What happens next depends on where the keys are kept.
In a watch-only setup the keys stay on the owner's own device, often a hardware wallet, so the server can see the money but has no way to move it. In a hot wallet setup the seed, the master key that every address in the wallet comes from, sits on the server. That lets a shop send refunds or payouts from its dashboard. It also means that whoever runs the server as an admin can spend the coins.
After the attack, Dorier advised users not to keep too much in a hot wallet.
03 · The timelineThree days, hour by hour
The first sweep we can see came early on 30 October, less than a day after BTCPay shipped version 2.4.7. It emptied a wallet of 42 addresses into a second wallet tied to the thief. That wallet passed the coins on to the named Bitcoin address later that day. A trickle of smaller sweeps followed over the next day and a half.
Then the pace changed. Litecoin sweeps began on 1 November, and the Bitcoin wave started within the hour. Over the next eight hours the thief took 87% of everything we counted. The busiest single hour moved $725K.
BTCPay's alert went out late that evening. By then the wave had mostly passed. The sweeps did not stop.
04 · The lossesHow much the BTCPay Server hack took
Bitcoin made up 88% of the value, and Litecoin the rest. We value both coins at Monday morning's prices.
Most sweeps were small. About half were worth less than $100, the kind of balance a shop builds from a few days of modest orders. A few dozen large ones carried three quarters of the money.
On Bitcoin the gap is sharper still. The ten largest sweeps hold 60% of the bitcoin taken.
05 · The biggest lossesThe wallets that lost the most
A bitcoin wallet holds its money as separate coins, one for each payment it has received. A shop that has taken thousands of small orders ends up with thousands of coins, and moving them all takes a large transaction.
The largest loss came in a single block on 1 November. Three sweeps landed together, each built from 566 coins, worth $421K between them. Sweeps that share a block and a coin count point to one wallet, emptied in three parts. Another sweep that evening gathered 1,316 coins worth $62K.
We do not name any victims. The chain shows only wallets.
06 · After the alertThe alert did not stop it
Shutting a server down stops a thief who needs that server to sign. Owners who saw the alert could do that at once, and BTCPay said some hosting companies switched old servers off for their customers. Not everyone heard in time.
After the alert we counted 267 more sweeps, worth $150K. They kept coming in each hour through the night, and they were still coming in when we stopped counting at six the next morning.
07 · The second walletA second wallet tied to the thief
BTCPay named one Bitcoin address. Part of the money reached it through a second one.
Early on 30 October, a wallet of 42 addresses was emptied into this second wallet in one go. The sender paid a fee about 20 times the median in that block. People do that when they want a payment through fast. About five hours later the second wallet sent those coins to the named address. They were among the first coins the named address received.
After that the two wallets acted as one. On the afternoon of 1 November they paid the same fresh address in the same block, at the same fee rate. Four and a half hours later they paid out together again, in one block, at a matching fee. Both send their change, the leftover from each payment, back to themselves.
We treat the second wallet as the thief's, with moderate-high confidence. Another 0.26 BTC came into it and never reached the named address. Our totals leave that out.
08 · The moneyWhere the stolen money went
The thief started paying bitcoin out ten minutes after the first coins came in, and over the next three days made 17 payments, each to an address that had never been used before the theft. The two largest went out on 1 November, and one of them was confirmed four minutes after BTCPay's alert.
None of those addresses had spent anything when we stopped counting, apart from two early ones whose coins moved on a step or two and then stopped. About $1,600 reached a wallet that has been in use since February. The Litecoin address has never sent a coin.
No address on the trail matches Bitquery's address labels, so we cannot yet say who holds them. Fresh, single-use addresses that receive round amounts are what deposit addresses at swap services and exchanges look like. They are also what a thief's own storage looks like. The first time any of them moves, the chain should show which.
09 · The causeHow the thief got in
BTCPay has not given a full account yet. What it has said narrows things down. On Monday it said the attack targeted servers running version 2.4.1, shipped in July, or older. It said it had no credible reports of drains on the current version, 2.4.7. Dorier said the thief "managed to log in as admin", and that BTCPay had "traces that pre 2.4.2 vulnerabilities were used".
Version 2.4.2, shipped in August, fixed two serious holes. One let anyone on the internet copy the files that control a server's Lightning node. BTCPay said at the time that attackers had used it to steal Lightning funds. The other let someone who knew an account's password sign in through BTCPay's programming interface without the two-factor code. In its August advisory, BTCPay said the first hole did not affect hot wallets.
A server still on 2.4.1 or older had gone at least 86 days without that fix when the main wave hit. BTCPay has not said which hole, or which mix of them, gave the thief admin access.
The first sweep also came less than a day after version 2.4.7. That release fixed 85 problems found by an AI code scanner that Anthropic runs for open-source projects. Published fixes show where software used to be weak. The timing fits someone reading the new patches, but it proves nothing. BTCPay says it has no credible reports of drains on 2.4.7.
10 · What to doIf you run BTCPay Server
Update to 2.4.7 or later before the server goes back online. BTCPay says it has no credible reports of drains on that version.
If the server ran 2.4.1 or older, assume someone else may have had admin access. Read the wallet's transaction list for sends you did not make, and look for admin accounts or API keys you did not create.
Move the money out of the hot wallet into a new wallet with a new seed, one whose keys never touch the server. Keep only what you need for refunds and payouts on the server itself. Change admin passwords and replace each API key. Turn on two-factor sign-in.
If you lost money, send the details and your logs to security@btcpayserver.org, as BTCPay asked.
11 · The limitsWhat we could not measure
We cannot say how many BTCPay Servers were hit, because the chain records only wallets. A sweep empties a wallet completely and leaves no change behind to link one sweep to the next. One shop swept five times looks the same as five shops swept once.
We counted the two addresses BTCPay named, plus the second wallet we tied to them, but BTCPay Server can also take other coins and Lightning payments, and we did not count those. Any other addresses the thief used are missing too, so each total is a floor.
12 · The methodHow we traced the BTCPay Server hack
We started from the two addresses Dorier posted. On each chain we listed every transaction that paid them. Then we followed each payment the thief made, one step at a time, until the coins stopped. We checked each address on the trail against Bitquery's labels and found no match. Any Bitcoin hack leaves a public trail like this one. Anyone can follow it. Both counts stop at 06:00 UTC on 2 November.
The full history of both chains is also sold as files on the Bitquery Data Store, in the Bitcoin dataset and the Litecoin dataset. For an earlier study we read every Litecoin block since 2011. We have traced other thefts this year, too. They include the Coldcard wallet hack on Bitcoin, and the b14g drain and Name.com DNS hijack of 31 October. For cases like these we also run crypto investigation services.
Bitcoin transfers were read up to block 974,216 (05:42 UTC on 2 November) and Litecoin transfers up to 06:00 UTC that day. Sweeps after that are not counted, and they were still arriving.
A sweep is one transaction that paid a named address and that the address did not fund itself. We count transactions, not servers or victims.
Values use one price per coin, $78,326 per bitcoin and $55.54 per litecoin, from Bitquery's hourly prices on the morning of 2 November. A 5% move in bitcoin's price moves the total by about $72K.
Nothing labels the second wallet; we tie it to the thief by how it behaved. The 0.26 BTC that came into it without reaching the named address is not in the totals.
Totals cover only the two addresses BTCPay named and the wallet tied to them. Other addresses and other coins, Lightning included, are not counted, so every total is a floor.
No address on the trail matched a label in Bitquery's data. Who holds the payout addresses is not known.
13 · The recordThe addresses behind the BTCPay Server hack
Follow the thief's addresses in plain English
Every transaction in this story comes from Bitquery's blockchain data. The Bitquery MCP server puts that data behind an AI assistant, so you can ask where an address sent its coins, or which wallets paid it, without writing a query. The full history is also sold as files on the Bitquery Data Store, as the Bitcoin dataset and the Litecoin dataset.
This article is provided for informational and educational purposes only and reflects analysis of publicly available on-chain data as of the dates indicated. It does not constitute legal, financial, compliance, security or investment advice, and nothing in it is a recommendation to buy, sell or hold any coin or asset, or to use or avoid any software, wallet, hosting provider, exchange or service.
The findings describe transactions and balances observed on Bitcoin and Litecoin between 30 October and 2 November 2026. Attributions come from on-chain behavior and from addresses BTCPay Server's developers published; they may be incomplete or incorrect and may be revised as more data becomes available.
References to BTCPay Server, its developers, Anthropic or any other named project, company or person describe what the public record shows and what those parties have said in public. They are not statements about any party's intent, security practices or conduct, and nothing here asserts that any named party acted unlawfully or negligently. Victims are not named. The wallets that took the funds are described by their behavior and attributed to nobody.
Nothing herein should be relied upon as a definitive determination of fact. Readers should conduct their own independent verification before taking any action. The authors and publisher accept no liability for any loss or damage arising from reliance on this material. All trademarks and company names are the property of their respective owners.
Reported by Gaurav Agarwal for Bitquery Research, with AI tools; every figure was checked against the raw data.
FAQ
Was BTCPay Server hacked?
Self-hosted BTCPay Servers running version 2.4.1 or older were broken into, and their hot wallets were emptied. BTCPay said it had no credible reports of drains on the current version, 2.4.7, and that its own public servers were not attacked.
How much was stolen in the BTCPay Server hack?
We traced about $1.63M in bitcoin and litecoin to the two addresses BTCPay named. Sweeps were still arriving when we stopped counting.
Which BTCPay Server versions were affected?
BTCPay said the attack targeted servers running version 2.4.1, released in July 2026, or older. Version 2.4.2 fixed a two-factor login bypass and a Lightning credential leak in August.
Is BTCPay Server 2.4.7 safe to use?
BTCPay said it had no credible reports of hot wallet drains on 2.4.7. Its lead developer still advises updating often and keeping little in a hot wallet.
Can victims get their money back?
Nearly all the money still sat in addresses first used in the theft on the morning of 2 November. If any of it reaches an exchange that can freeze it, victims may have a chance. BTCPay asked victims to send details to its security address.
What is a hot wallet?
A hot wallet keeps its keys on a computer that is online, so it can send coins without a person signing each time. In BTCPay Server, the hot wallet's seed sits on the server itself.
Run the next investigation in minutes
Ask any question of the blockchain. Bitquery's AI Investigations agent traces funds, attributes wallets, and writes auditable reports across every major chain. Prefer to do it yourself? Connect the Bitquery MCP server to your AI assistant, pull the raw datasets, or query the chain directly with the Bitquery API.