BTCPay tells users to shut down their servers while the open-source project investigates reports that attackers drained bitcoin from merchants’ internet-connected hot wallets. BTCPay Server has not identified a loss total, the number of affected servers or a fix.
The project said Sunday that it received reports of unauthorized attackers sweeping hot wallets on some BTCPay Servers. “Swept” means the coins were moved out of a wallet in one go. It asked every server operator to switch off the software until the investigation is complete.
The warning was not limited to a particular software release. BTCPay did not announce a remedy or say how many businesses had reported losses. Its request leaves each merchant to stop its own server because the project cannot switch off privately hosted systems for them.
BTCPay Server is a free, open-source tool businesses can run on their own servers to accept bitcoin. The software lets merchants receive payments directly into their wallets without a middleman or third-party custodian, according to CoinDesk’s report.
Some merchants use internet-connected “hot wallets.” Their seed phrase, the secret needed to send coins, is stored on the server. BTCPay’s documentation says the software can use that seed to sign and approve a payment automatically. That setup allows a server to send coins without a merchant approving the transaction on a separate device.
The same arrangement creates a risk described in BTCPay’s documentation: someone who gains access to the server could send the wallet’s coins to another address. The documentation marks the feature with a “DANGER” label and warns of security implications. The current reports involve attackers gaining administrator access, but investigators have not established how they obtained it.
About two hours after the shutdown request, founder Nicolas Dorier said the theft reports “appear to involve” releases older than version 2.4.2. He did not say newer versions are safe. Dorier said the project’s own public servers, which run version 2.4.7, “were not attacked.”
The investigation remains open, and the shutdown advice applies to server owners while the team works to establish what happened. The report does not say whether the suspected version range explains how attackers gained administrator access.
BTCPay’s decentralized setup means each merchant hosts a separate instance on private infrastructure. The project therefore asked each operator to shut down its own server rather than relying on one central control to halt the service. Merchants were told to leave their servers off until the investigation is complete.
The warning follows a separate security incident in August. BTCPay then confirmed attackers stole funds through a flaw in versions before 2.4.2. That issue let an outsider obtain credential files for LND, software that runs a node on Lightning, a faster payments network built on bitcoin. The project fixed that flaw in version 2.4.2.
CoinReview News previously reported on Binance’s response to its hack, another incident involving stolen cryptocurrency. Its coverage of Arbitrum’s recovery action described a separate effort to move funds connected to that attack. A report on network-level crypto recovery examined broader proposals for responding when wallet protections fail.
The immediate next step is the investigation’s completion. Until BTCPay provides further findings or updated guidance, its request is for operators to keep their instances shut down; the source reports no announced fix or confirmed safety status for newer versions.
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Ut elit tellus, luctus nec ullamcorper mattis, pulvinar dapibus leo.
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Ut elit tellus, luctus nec ullamcorper mattis, pulvinar dapibus leo.
