On the night of November 1, BTCPay Server's first warning was blunt: shut your server down. Reports had come in that hot wallets on some installations were being drained, and the open-source bitcoin payment project did not yet know the hole. A day later the picture narrowed. Its investigation found the attacks targeted installations running version 2.4.1 or older. The current release, 2.4.7, has no credible reports of drains so far. So the message changed: no longer shut down, but update now. And for anyone still on an old version, updating alone is not enough.
What was hit, and what is still unanswered
BTCPay Server is used by merchants and services that accept bitcoin straight into their own wallets, with no custodial intermediary. Because it is self-hosted, patching is the operator's job, not something BTCPay can push from afar. Founder Nicolas Dorier said the attacks did not target public servers. The investigation focused on how the attacker managed to log in as administrator on installations running versions older than 2.4.2.
Version 2.4.2, released August 7, 2026, patched a critical vulnerability. According to BTCPay, the attackers used a different method to exploit the vulnerability fixed in that release. How the administrator access was obtained is still unknown, and BTCPay has not disclosed how many operators were affected or how much was taken in total. What it has published: two wallet addresses tied to the incidents, one for Bitcoin and one for Litecoin. The Bitcoin address is bc1p0f7wmcnesrapznymf9ljdn04pudgmh96sqtrm9vmgqxdh666fh8qvn63r7, and the Litecoin address is ltc1qp49tmfdueyaqrmgrx0uyx4uegyygt8yt02whee. Users who lost funds are asked to send details to security@btcpayserver.org and report to local authorities.
Version 2.4.7, and why a new wallet comes with it
Version 2.4.7 itself arrived as an emergency security update on October 29, after Anthropic's Frontier OSS scanner found one critical and several medium-severity vulnerabilities. For this release, BTCPay says it has no credible reports of hot wallet drains. But its advice to users on 2.4.1 or older goes further than pressing update: move to a fresh server with a new wallet, even where no theft is visible. The reason is practical. Credentials or keys that already leaked do not automatically expire when the software is patched.
The practical rule BTCPay repeated: a hot wallet should hold only the funds needed for daily operations. The rest belongs in a wallet whose spending keys are not stored on the server. Operators on hosting providers may find their instances were already shut down automatically as a precaution. The official update path runs through Server Settings, Maintenance, Update, or for Docker installs through the btcpay-update.sh script over SSH.
The second incident in three months
This is not BTCPay Server's first brush with theft. In August, a critical flaw that let a remote attacker obtain LND credential files was already being exploited, and the project restricted remote Lightning access. That August attack touched Lightning channels, not onchain hot wallets. Whether this attack is connected to the August flaw is still unclear, and BTCPay has not said the two share a root cause. What is clear: on self-hosted software, an old version is not just missing features. Here, an old version meant a wallet that could be drained. The lesson from a hijacked third-party script is in our Polymarket article. The Brazilian exchange incident, whose funds are also still being traced, is in our Chainalysis article.
Sources: BleepingComputer (Nov 2, 2026), The Hacker News (Nov 3, 2026), BTCPay Server incident report (Nov 2, 2026). Figures and status are snapshots at writing time, afternoon November 3, 2026 WIB, and can change.
Written by Mastechon
Writing about crypto and Super Intelligence: market news, new projects, Super Intelligence models, and early opportunities like airdrops and testnets. Every piece starts from the official announcement, with the costs worked out up front.
Binance's SAFU wallet now holds 7,500 BTC, about $580 million, after four October 31 transactions halved its balance. A refill is pledged, with no date.
ZachXBT flagged a suspected $106 million theft from an EU entity's accounts at exchanges. The funds left as stablecoins, then were swapped into ETH and Monero.
Chainalysis estimates $49 million stolen from Mercado Bitcoin across 17 chains, with nearly $10 million frozen. The exchange itself puts $38 million involved.
From November 3, Anthropic adds an invisible watermark to 4 older Claude models. It changes nothing you read, but two models carry it only at default settings.
Binance finished the zero-knowledge proof for its October 31 snapshot: 10 tokens are now user-verifiable at 1:1. What changed, and what it does not cover.
Brazil's exchange halted withdrawals after a November 2 security incident. Researchers flagged over $40M in suspicious transfers, unconfirmed by the exchange.
Meituan released LongCat-2.5 on November 2: a multimodal model for long coding work, scoring 88.4 on Terminal Bench. Its parameter count is still disputed.
US spot Bitcoin ETFs lost $643.3 million net on Friday, October 30, their largest since June 25. Ether funds lost $155.9 million, yet Bitcoin rose to $78,491.
Apple and Alibaba announced October 31: Qwen will power Apple Intelligence in China. Developer beta starts November 4; public release with iOS 27.3 in December.
Binance reopened withdrawals in phases on November 1; the first 9.5 hours saw a net outflow of $3.64 billion, 2.1% of reported assets. Flows are stabilizing.
A page-speed script from DebugBear on Polymarket's site was replaced with malicious code on October 29. It used signed-in traders' sessions to move positions, hit 726 wallets, and Polymarket refunded $3.9 million.
DeepSeek released its open-source Super-agent prototype on October 31: a coding agent that watches team chat and proposes fixes without being called. What shipped, its limits, and safe pilot conditions.
Google's prototype satellite answered its first prompt from orbit with a haiku from the Gemma 4 model. What it proves, its limits, and the twin-satellite plan for 2027.
Binance opened phase one withdrawals November 1 and says 95% of the $6.3B stolen is replaced. What changed since the midday schedule, and what is still pending.
Binance has set phase one of its withdrawal reopening for today, November 1, 06:00-09:00 UTC across 15 networks. Here is the schedule, Binance's own warning, and what is still unproven.
The FBI says North Korea was behind the October 29 theft from Binance and asks crypto firms to block hundreds of linked addresses, as most of the stolen funds are converted into ether.
Bitcoin staking platform b14g paused affected contracts after unauthorized withdrawals on October 31; about 68 million CORE is still traceable on the Core network and 9 million was frozen by exchanges, while staked BTC was unaffected.
ICE and Trade[XYZ] agreed to build a regulated perpetuals venue on Hyperliquid, HYPE jumped to near $90, but nobody has said whether fees from the US venue flow back to HYPE holders.
Two days after the $6.3 billion hack, Binance says 10 major assets are fully backed, the remaining 10% is still being sourced because those tokens are less liquid, and full reserve proof is due November 3.
Mistral opens a 1-trillion-parameter model to everyone, Google locks down its top-ranked model, Bitcoin steadies after the Binance hack, plus a free VPS and free Super Intelligence video that are still live.
A cross-checked roundup of what X is talking about: the largest hack in crypto history at Binance, Bitcoin's market reaction, trending coins, and this week's open airdrop claim windows.
What a crypto airdrop is, why projects give away free tokens, the requirements they usually ask for, and the realistic outcomes to know before you start.
Testnets use fake money, but your accounts and wallet are real. How to join testnets safely: a dedicated wallet, official faucets, and verification habits.
