BTCPay Server has urged operators to shut down their self-hosted payment servers after reports that attackers were sweeping Bitcoin from hot wallets on some instances. In a November 1 post, the open-source project said it was investigating unauthorized wallet drains and instructed operators to run ./btcpay-down.sh until the investigation is complete. The project’s warning did not identify a confirmed cause or provide a loss total.
BTCPay lets merchants accept Bitcoin using infrastructure they operate themselves. Its wallet documentation explains that a hot wallet can store its signing seed on the server, allowing it to sign transactions while connected to the internet. That convenience also means server access is a critical security boundary.
BTCPay founder Nicolas Dorier later said the theft reports appeared to involve releases older than version 2.4.2 and that attackers had logged in as administrators on affected servers. He said the project’s own public servers running version 2.4.7 had not been attacked, but did not declare all newer installations safe. CoinDesk’s reporting and TokenPost’s follow-up describe the update; the route used to obtain administrator access remains unknown.
The project released BTCPay Server 2.4.7 on October 29 to address 85 security findings, including one critical issue, according to its official release notes. The project has not linked those fixes to the current wallet-sweeping reports. It has also not disclosed how many installations were affected or how much Bitcoin was stolen.
The incident adds to recent crypto-custody concerns, including Trezor’s warning about a suspected hardware implant in devices sold by CryptoBilis. It also follows the $6.3 billion Binance breach and its phased withdrawal restart, though the incidents have not been linked.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
