BTCPay Server has issued an emergency security warning after receiving reports of attackers draining Bitcoin from hot wallets hosted on its payment infrastructure, urging operators to shut do
BTCPay Server has issued an emergency security warning after receiving reports of attackers draining Bitcoin from hot wallets hosted on its payment infrastructure, urging operators to shut down their servers while investigators determine the extent of the compromise.
The November 1 alert initially applied to all installations, but subsequent findings narrowed the suspected attack vector to BTCPay Server versions 2.4.1 and earlier. The project has received no credible reports of hot wallet thefts involving its latest 2.4.7 release.
The total amount stolen, number of affected merchants and exact method used to compromise the servers remain undisclosed.
BTCPay Server urged operators to immediately shut down their instances using the ./btcpay-down.sh command after reports emerged of unauthorized withdrawals from internet-connected wallets.
The open-source payment processor allows merchants to accept Bitcoin and Lightning Network payments without relying on centralized custodians. However, its optional hot wallet functionality stores signing credentials on the server, potentially exposing funds if attackers gain administrative access.
Founder Nicolas Dorier said preliminary investigations showed that attackers had successfully logged into affected servers as administrators, although the method used to obtain that access was still being examined.
The compromised installations appeared to be running versions released before August 2026, when BTCPay Server introduced version 2.4.2 to address several security weaknesses.
The team subsequently identified an attack vector affecting versions 2.4.1 and older, while noting that its own publicly accessible servers running the latest release had not been compromised.
The findings come days after BTCPay Server released version 2.4.7 on October 29, addressing 85 security findings identified through Anthropic’s open-source security scanning program.
Those fixes included one critical, 13 high-severity, 52 medium-severity and 19 low-severity issues, covering authentication, payment processing, API access and other components.
Although the latest release has no confirmed hot wallet losses, the investigation has not yet established which specific vulnerability enabled the November attacks.
The incident follows an August breach involving BTCPay Server’s Lightning Network integration.
Attackers previously exploited a vulnerability allowing unauthorized access to LND administrative credentials, potentially enabling them to control connected Lightning nodes and transfer funds.
That weakness was identified during a broader Bitcoin security review and patched in version 2.4.2. The earlier incident affected LND-connected funds rather than BTCPay Server’s standard on-chain hot wallets.
Security concerns have also extended to other Bitcoin applications. In August, Core Lightning urged node operators to disconnect while developers prepared security updates.
More recently, Electrum patched an actively exploited wallet vulnerability after attackers manipulated transaction data to redirect Bitcoin payments.
BTCPay Server is now urging affected operators to contact them with relevant logs and incident details. Users are also advised to keep installations updated, minimize funds stored in hot wallets and transfer remaining assets to secure cold storage where necessary.
Some hosting providers have proactively suspended customer instances running vulnerable software to prevent further losses.
The investigation remains ongoing, with no confirmed recovery figures or complete technical explanation published. While the latest software appears unaffected by the identified attack vector, the incident underscores the risks of outdated self-hosted payment infrastructure, particularly when private keys remain accessible on internet-connected servers.
The post BTCPay Server Warns of Wallet Drains, Urges Shutdown appeared first on Crypto Adventure.
