BTCPay Server Urges Shutdown After Reports of Hot-Wallet Sweeps

BTCPay Server, an open-source Bitcoin payment processor, told operators on Sunday to shut down their instances after receiving reports that unauthorized attackers were draining hot wallets.

“We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers,” the project wrote in an alert posted at 5:25 p.m. ET on Nov. 1. It instructed operators to run ./btcpay-down.sh and leave instances shut down until it completes its investigation.

The alert did not give a confirmed loss amount or tally of affected instances, identify vulnerable versions or configurations, or announce a patch. Its shutdown instruction was not limited to a particular version.

BTCPay is self-hosted software, putting the shutdown instruction in the hands of individual server operators. Its wallet documentation explains that its hot-wallet feature uses a seed stored on the server to sign transactions, allowing funds to be spent without an external signing device.

An Earlier Lightning Credential Theft

The warning follows an August incident covered by The Defiant in which BTCPay confirmed that attackers had stolen funds from users of LND, software for running Lightning payments nodes.

The project's advisory for that incident says a vulnerability in versions before 2.4.2, including its release candidates, let unauthenticated remote attackers obtain LND credential files. Those credentials could be used to control a node and move funds. Version 2.4.2 fixed the flaw.

BTCPay said its own onchain wallets, including hot wallets, were not affected by that earlier vulnerability, though funds in LND's own onchain wallet could still be at risk. Sunday's alert did not say whether the reported sweeps were connected to the August vulnerability.