BTCPay Server has issued an urgent warning after reports that attackers were draining Bitcoin hot wallets on its servers. The open-source payment processor told operators to shut down affected installations immediately and keep them offline while the team investigates. For merchants using wallet management through these servers, the warning is about more than software hygiene. It is about funds that may already be exposed.
Shutdown order and early signals
In its November 1 security notice, the project said it was receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers. Operators were instructed to run ./btcpay-down.sh until the investigation is complete. The notice did not limit that guidance to certain software versions, and it did not say that restarting was safe.
Founder Nicolas Dorier reportedly said the affected servers were running versions older than 2.4.2 and that attackers had logged in as administrators. The important detail is what remains unknown: investigators had not established how that access was gained. At this point, the entry point has not been confirmed.
Dorier also said the project’s public servers running version 2.4.7 had not been attacked. That is a useful data point, but it does not amount to a blanket clearance for every updated installation. The broader shutdown warning still stands, and operators are being told to keep servers offline while the issue is examined.
What is known about the wallet risk
BTCPay Server lets merchants accept Bitcoin directly through self-hosted software. Its wallet documentation explains that an enabled hot wallet signs transactions using a seed stored on the server. That convenience comes with a clear tradeoff: sensitive signing material lives in an online environment. If an attacker gets the right level of access, funds can be put at risk.
The reports so far do not include a confirmed loss total or a count of affected installations. There is also no complete technical account showing whether the attackers used stolen credentials, a software flaw, or another route to administrator access. Those missing details matter because they shape both recovery and trust.
Recent patches and what they do not prove
The warning came after BTCPay Server 2.4.7, released October 29. The official release notes list 85 security findings addressed after reports from Anthropic’s OSS Scanner program. Those findings included one critical, 13 high, 52 medium, and 19 low-severity issues across permissions, authentication, payment handling, and other functions.
That patch history does not confirm the cause of the current wallet drains. A separate earlier advisory for version 2.4.2 dealt with exposed Lightning Network Daemon credentials, and BTCPay said its own on-chain wallets, including hot wallets, were not affected by that earlier issue. Mixing those incidents together would blur what the developers have actually confirmed.
For now, the clearest instruction is the simplest one: stop the server with ./btcpay-down.sh and leave it offline until further guidance arrives. Updating alone should not be treated as proof that an active compromise has been resolved, especially while the team is still determining the attack path, the affected deployments, and the next recovery steps.
Licensed under CC BY-ND 4.0 International