coindesk.com
BTCPay Server, a free, open-source tool businesses use to accept bitcoin payments, urged its users on Sunday to switch off their servers.
The alert came after the project received reports that attackers were draining “hot wallets” on some of those servers.
As open-source software, BTCPay Server allows anyone to deploy and run the system on their own servers, the computers that keep the software running around the clock.
Because there are no middleman or third-party custodians, businesses receive bitcoin payments directly into their own wallets, and BTCPay lets them run these as hot wallets, which stay connected to the internet.
However, this ease of transacting comes with two risks.
The first is the hot wallet. Each one lives on an individual merchant’s own server. What makes it hot is that the seed phrase, the secret needed to send coins, is stored on that server, which is connected to the internet. This wallet can also accept payments without needing the seed.
BTCPay’s documentation says BTCPay Server will then “automatically use the seed stored on a server to sign” and approve a payment.
So the merchant’s server can send the coins out on its own, without the merchant approving it on a separate device. That is convenient, but anyone who breaks into that server can send the coins to their own address. The documentation marks the feature with a “DANGER” label and says it “comes with security implications.”
The second is decentralization. Every merchant hosts the software on their own private server. Hence, there is no master switch to flip when something goes wrong. Every business owner is independently responsible for securing their own infrastructure.
This is why BTCPay had to ask each server owner to shut down. It cannot do it for them.
“We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers. If you’re running an instance, please shut it down (./btcpay-down.sh) until we complete the investigation,” BTCPay said on X.
Swept means the coins were moved out of the wallet in one go. The command, ./btcpay-down.sh, stops the software. BTCPay asked owners to leave it off until the investigation is complete.
BTCPay did not specify a loss amount or give a count of affected servers. It named no software versions, announced no fix, and the shutdown call was not limited to one version.
