.png){kind=logo}
BTCPay Server has urged operators to shut down their payment servers following reports that attackers emptied connected Bitcoin hot wallets. In a November 2 update, the open-source payment project identified an attack method targeting older software versions. The team has not disclosed the amount stolen or the number of affected servers.
BTCPay Server first warned users on November 1 that unauthorized attackers were moving funds from hot wallets. In a post on X, the project asked operators to stop their installations using the command ./btcpay-down.sh. The request initially covered all versions while investigators examined the reports.
The software allows merchants to accept Bitcoin payments directly without a payment company holding their funds. Each business runs its own server and controls its wallet settings. However, operators can choose a hot wallet that keeps the information needed to authorize payments on an internet-connected server.
A person who gains sufficient access to that server may be able to transfer funds without the owner's approval. BTCPay's initial alert described reports of wallets being “swept,” meaning attackers had moved their available coins. The project did not initially identify the cause or announce a new security fix.
On November 2, BTCPay Server said investigators had identified an attack route affecting versions 2.4.1 and earlier. The project said it had received “no credible reports” of hot wallet drains among users running version 2.4.7. That statement does not establish that every newer installation is free from security risks.
Founder Nicolas Dorier said reports appeared to involve versions released before 2.4.2. According to Dorier, attackers had logged into affected servers with administrator privileges. He said investigators were still working to determine how the attackers obtained that access.
Dorier also reported that the project's public servers, which ran version 2.4.7, had not been attacked. BTCPay encouraged operators to keep their installations updated. Meanwhile, the project asked anyone affected to send incident information and server logs to its security team at security@btcpayserver.org.
The latest reports follow an August security incident involving another flaw in older BTCPay Server versions. That issue allowed attackers to obtain administrator credentials for LND, software used to process payments on Bitcoin's Lightning Network. BTCPay confirmed that attackers exploited the flaw and stole funds from connected Lightning wallets.
The project released version 2.4.2 to address the August weakness. Its earlier advisory said the attack did not affect ordinary on-chain wallets, including BTCPay hot wallets. Investigators have not confirmed whether the November withdrawals involved the same weakness or a different route into outdated servers.
Hosting providers also responded to the latest warning. BTCPay said some providers, including LunaNode, had shut down customer installations as a precaution. Because merchants operate separate servers, the project cannot switch off every affected installation from one central system.
BTCPay has not published a complete count of compromised servers, a verified total for stolen cryptocurrency or a recovery schedule. It has also not explained the full technical method behind the reported administrator access.
The project has not identified any affected merchants or said whether attackers targeted only one particular hosting provider. The investigation remains underway as operators review their installations and wallet activity.
ALSO READ: FBI Confirms North Korea Behind USD 6.3 Billion Binance Hack, Flags Crypto Wallets