BTCPay Server tells users to shut down their software after reports of drained hot wallets
BTCPay asks merchants to switch off servers amid wallet theft reports
BTCPay Server, a free and open-source tool that businesses use to accept bitcoin payments, told users on Sunday to shut down their servers. The warning came after the project received reports that attackers were draining bitcoin from "hot wallets" — wallets that stay connected to the internet — running on some of those servers.
BTCPay said on X: "We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers. If you're running an instance, please shut it down (./btcpay-down.sh) until we complete the investigation."
The command ./btcpay-down.sh stops the software. "Swept" means the coins were moved out of the wallet in one go.
Key points
- BTCPay Server asked all server owners to shut down their software while it investigates the reports.
- Founder Nicolas Dorier said the theft reports appear to involve versions older than 2.4.2.
- An attacker logged in as an administrator on the affected servers, but the team does not know how.
- BTCPay gave no loss amount, no count of affected servers, and announced no fix.
- The project's own public servers, which run version 2.4.7, were not attacked, according to Dorier.
What the founder said
About two hours after the shutdown call, BTCPay founder Nicolas Dorier shared more detail. He said the reports "appear to involve BTCPay Server releases older than version 2.4.2" — in other words, servers that have not updated to 2.4.2 or later.
He did not say whether newer versions are safe. He said only that the project's own public servers, running version 2.4.7, "were not attacked." He also said an attacker had administrator access — top-level account access — on the hit servers, and the team does not yet know how that access was gained.
Why hot wallets on BTCPay carry risk
BTCPay Server is open-source software, meaning anyone can run it on their own server — a computer that keeps the software running around the clock. There is no middleman or third party holding the funds. Businesses receive bitcoin payments directly into their own wallets.
With a hot wallet, the seed phrase — the secret needed to send coins — is stored on the merchant's own internet-connected server. BTCPay's documentation says the server will then "automatically use the seed stored on a server to sign" and approve a payment. That means the server can send coins out on its own, without the merchant approving each payment on a separate device. Anyone who breaks into that server can send the coins to their own address. The documentation marks the feature with a "DANGER" label and says it "comes with security implications."
BTCPay's decentralized design also played a role in the response. Every merchant hosts the software on their own server, so there is no master switch to flip. Each owner had to be asked to shut down individually.
What is confirmed
- BTCPay Server publicly asked users to shut down their servers while it investigates.
- BTCPay reported that hot wallets on some servers were swept by unauthorized attackers.
- Dorier said the reports appear to involve versions older than 2.4.2.
- Dorier said an attacker had administrator access on the affected servers.
- Dorier said the project's own public servers running version 2.4.7 were not attacked.
- BTCPay did not name a loss amount or a number of affected servers.
What is still unclear
- How attackers gained administrator access on the affected servers.
- Whether newer versions are safe — Dorier did not confirm this.
- The total amount stolen and how many servers were affected.
- Any fix or patch has not been announced.
Not the first security problem this year
In August, BTCPay confirmed that attackers had stolen funds through a flaw in versions before 2.4.2. That flaw let an outsider grab credential files for LND, software that runs a node on Lightning — a faster payments network built on bitcoin. With those files, an attacker could control the node and move its funds. BTCPay fixed the issue in version 2.4.2.
The BTCPay alert also follows Thursday's Binance hack, in which the exploiter drained cryptocurrencies worth over $6 billion. That is reported to be the largest exploit in the crypto industry's history.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.