Which companies just had a verified incident, who lends to them and who owns them. Every claim carries its evidence level and its source. How we decide what is confirmed
BTCPay Server
crypto payments (merchant processor software) · Global (self-hosted; hosting providers including LunaNode)
What happened
Hot wallets (seed stored on server) on instances running affected releases; BTC and LTC stolen; BTCPay says to treat the whole machine and its secrets (hosting, SSH, API, Lightning credentials) as compromised where funds were stolen.
Merchants on affected versions lose BTC checkout while shut down; hot-wallet balances stolen at an unknown number of merchants.
Confirmed affected parties
- Merchants on self-hosted BTCPay affected releases (count undisclosed)
- Hosting providers asked to take instances offline (LunaNode named)
What remains unknown
- How administrator access was obtained
- Number of instances and merchants affected
- Total BTC and LTC stolen
- Whether exploitation is still ongoing on unpatched instances
- Any U.S. merchant victims
Losses: unknown; BTCPay gives no total and warns that balances at reported addresses are not confirmed losses; DefiLlama lists the incident with no amount
Capital around this company
DFX holds no verified lender or owner record for this organization yet. That is a gap in our coverage, not evidence that none exists.
Sources
- BTCPay Server blog: Security Incident Affecting BTCPay Server 2.4.1 and Earlier · 2026-11-02
- BTCPay Server blog index · 2026-11-02
- BTCPay tells users to switch off servers after reports of drained wallets (CoinDesk, baseline) · 2026-11-02T04:41Z
- Another bitcoin infrastructure exploit hits, draining merchant Lightning nodes (CoinDesk, Aug 2026, baseline) · 2026-08-08
- DefiLlama hacks API (entries dated 30 Oct to 2 Nov) · live
Does BTCPay Server touch your portfolio?
We map a company or a whole book against verified incidents: the lenders, owners and providers around each holding, with what is confirmed and what is not.