BTCPay Server told operators to shut down their instances on Nov. 1 after receiving reports that attackers were draining bitcoin from hot wallets connected to self-hosted payment servers. The project said the alert was precautionary while developers investigated how the compromises happened and how many merchants were affected.
Founder Nicolas Dorier later said the known incidents appeared tied to deployments running versions older than 2.4.2. He added that public and demo servers on version 2.4.7 had not been attacked, though the project had not published a complete technical explanation or a confirmed loss figure.
Emergency warning issued
At about 22:25 UTC on Nov. 1, BTCPay Server’s official account posted an urgent notice saying it was receiving reports of hot wallets being swept by unauthorized attackers. Operators were instructed to bring their systems down with the ./btcpay-down.sh command until investigators could determine what had occurred.
Core contributor Uncle Rockstar Developer amplified the message with a blunt warning that operators using hot wallets should shut down immediately. BTCPay Server is open-source software that lets merchants accept bitcoin directly while running their own infrastructure, which means wallet security depends in part on how those independent servers are maintained.
Older versions become the focus
As the investigation narrowed, Dorier said preliminary findings pointed to installations running software predating version 2.4.2. According to his account, attackers appeared to have obtained administrator access, with forensic traces indicating vulnerabilities present in those older releases.
He also said public-facing and demonstration servers running version 2.4.7 had not been compromised. That detail suggested the latest release was not itself the cause of the theft reports, but it did not amount to a guarantee that every up-to-date deployment was safe. Developers had still not confirmed whether one flaw, several flaws, or an operational weakness was behind the incidents.
Security fixes landed days earlier
The warning came only three days after BTCPay Server published version 2.4.7 on Oct. 29. That release followed vulnerability reports generated through Anthropic’s open-source security scanning initiative and included fixes for 85 findings: one critical issue, 13 rated high severity, 52 medium, and 19 low.
BTCPay had also dealt with a separate issue in August affecting Lightning Network Daemon macaroon credentials, which act as authorization tokens. That vulnerability was fixed in version 2.4.2, and developers previously said BTCPay’s own onchain wallets were not exposed through that specific flaw. It remains unconfirmed whether the latest thefts are related to that earlier issue or to other weaknesses in older software.
Merchants pause services as probe continues
Some businesses, including Coincards, took BTCPay installations offline after the alert. For merchants using the software, the incident created an immediate choice between keeping payment processing online and protecting funds held in internet-connected wallets.
As of the latest updates in the source material, BTCPay developers had not released a total loss estimate, a new incident-specific patch, or an all-clear message. Dorier reiterated a longstanding risk-control point: operators should keep only limited balances in hot wallets. The next confirmed step was a fuller explanation from developers once the investigation produced clearer technical findings.
Source: news.bitcoin.com