BTCPay urges users to shut down servers after attacker drains bitcoin from hot wallets

BTCPay Server advised users to immediately take their servers offline after a series of reports revealed that attackers had drained bitcoin from merchants’ hot wallets. The open-source payment processor, widely used by businesses for accepting bitcoin directly, stated that it is still investigating the incident and has not confirmed the extent of the losses or released details on a solution.

Users warned to shut down instances

BTCPay Server, an open-source platform that allows merchants to receive bitcoin without intermediaries, said the alerts relate to unauthorized sweeping of funds from hot wallets. The move came as multiple users reported bitcoin disappearing from wallets connected to internet-facing servers.

The project called for urgent action from all users, regardless of the version in use, advising immediate manual shutdown using the command ./btcpay-down.sh. Unlike managed custodial platforms, every BTCPay Server instance is hosted individually by merchants, meaning each business is responsible for its own infrastructure and security measures.

BTCPay explained that because hot wallets store the seed phrase on internet-connected servers, attackers who gain access can move funds. The team highlighted that server security is critical and pointed to documentation warning of these risks, labeling the feature as dangerous and cautioning users about potential attacks.

Targeted versions and ongoing investigation

Founder Nicolas Dorier indicated that the reported incidents appear to affect BTCPay Server versions older than 2.4.2. He stated that while the servers operated by the project itself, running version 2.4.7, had not been attacked, he did not confirm whether newer versions are completely secure.

Dorier revealed the attacker obtained administrator-level access to the impacted servers, giving them full control over the affected wallets. The method used to achieve this access remains under review, with no fix or clear remedy announced so far. BTCPay has yet to specify how much bitcoin was stolen or the total number of servers involved.

BTCPay Server advised users, “We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers. If you’re running an instance, please shut it down (./btcpay-down.sh) until we complete the investigation.”

In a similar security incident last August, BTCPay patched a vulnerability affecting versions released before 2.4.2. That flaw allowed attackers to access credentials for LND, Lightning node software, and control related assets. BTCPay resolved the issue in version 2.4.2.

Context of broader crypto security concerns

The BTCPay incident follows the recent exploit at Binance, where hackers drained over $6 billion in crypto assets, marking the largest such attack on record. This latest wave of breaches has drawn attention to the risks associated with hot wallets and decentralized server setups.

For users and merchants seeking real-time updates on critical vulnerabilities and market events, CryptoAppsy can deliver immediate alerts whenever incidents or large withdrawals are detected in the bitcoin ecosystem. Its customizable notifications keep businesses informed about sudden wallet movements, allowing them to respond quickly and monitor their holdings with greater control.

BTCPay’s documentation warns that allowing servers to auto-sign transfers with stored seeds is convenient but introduces significant risk, as anyone with server access can move funds without additional approvals.

Investigations continue, and BTCPay Server has committed to provide further updates once the scope and root cause are clarified. Merchants are being encouraged to keep their servers offline until more details are available regarding mitigation or patch availability.