BTCPay Server Tells Operators To Shut Down After Bitcoin Hot Wallet Drains

Shutdown Order After Sweeps

BTCPay Server told operators to shut down their instances after the project received reports of attackers sweeping Bitcoin from internet-connected hot wallets. BTCPay founder Nicolas Dorier said the reported thefts "appear to involve releases older than version 2.4.2" and said the project’s public servers running version 2.4.7 "were not attacked." BTCPay’s initial alert applied to every deployment regardless of version and directed operators to run "./btcpay-down.sh" until the investigation was complete.

Command to stop4 of 8 outlets reported it · not in grafa and 3 more▾

BTCPay Server said it had not disclosed how much bitcoin was taken or how many servers were affected, and it said it had not confirmed that newer versions are safe. BTCPay Server’s warning followed an August flaw in pre-2.4.2 versions that let attackers seize LND credentials, and it came two days after a Binance exploit drained more than $6 billion.

Reporting for this sectionBigGo Finance

Versions Narrowed, Access Confirmed

BTCPay Server’s investigation traced the hot-wallet drain to compromised instances running version 2.4.1 or older, and it urged operators to update to version 2.4.7.

BTCPay Server founder Nicolas Dorier confirmed that intruders logged in as administrators, while the project said it was still determining how they obtained those credentials.

Admin access6 of 9 outlets reported it · not in Cointelegraph and 2 more▾

BTCPay Server said it had received no credible drain cases on version 2.4.7 as of Nov. 2, while it stopped short of claiming every outdated installation had been hit.

BTCPay Server asked affected users to send logs to its security team after its follow-up narrowed the target range to older releases.

Logs requested6 of 9 outlets reported it · not in BigGo Finance and 2 more▾

Cointelegraph reported that BTCPay also shared shutdown instructions, and the project’s second message mattered because it pinpointed the affected versions and named 2.4.7 as the current release.

Reporting for this sectionBitcoin Foundation

What Merchants Face Next

BTCPay Server’s warning left merchants facing an unresolved security investigation, with the project asking operators to keep affected servers offline until further notice. BTCPay Server’s wallet documentation explained that its hot-wallet feature keeps the seed phrase on the same internet-facing machine that processes payments, and it said the software will "automatically use the seed stored on a server to sign" transactions. BTCPay Server’s architecture meant that a compromised administrator account could empty a merchant’s balance, and the project said it had neither the visibility nor the authority to assess how widely that had happened.

BTCPay Server said it had not disclosed the number of affected operators, the value of stolen funds, or technical details explaining how attackers accessed the wallets. BTCPay Server urged operators to treat the absence of reported attacks against its public servers running version 2.4.7 as not an all-clear, while it continued investigating the intrusion method and recovery steps.

Reporting for this sectionBigGo FinanceCyberSecurityNews