BTCPay Server, an open‑source platform used by merchants to accept Bitcoin payments, issued an advisory on Sunday urging operators to shut down their instances. The warning followed reports that attackers were sweeping hot wallets linked to servers running older software versions.
Attack details and response
In a tweet posted at 5:25 p.m. ET, BTCPay Server announced that hot wallets on its servers were being targeted and instructed users to execute the ./btcpay-down.sh command until the investigation was complete. Founder Nicolas Dorier later clarified that the incidents appeared to involve releases older than version 2.4.2, with attackers gaining administrator access.
The project’s investigation identified version 2.4.1, released on July 23, or earlier, as the vulnerable range. BTCPay confirmed that it had received no credible reports of hot‑wallet drains from users running the latest 2.4.7 release, which was issued as an emergency update on Thursday.
Mitigation steps
BTCPay advised all operators to update to version 2.4.7 and to submit logs and details of any suspicious activity to its security team. Some hosting providers, such as LunaNode, have automatically disabled BTCPay instances running outdated versions to prevent exploitation.
Background on BTCPay security
BTCPay Server is self‑hosted, meaning each merchant runs the software on their own server. The platform offers a hot‑wallet option that stores the wallet seed on an internet‑connected server for automatic transaction signing. Documentation labels this feature as “DANGER” and warns of security implications.
The emergency update to version 2.4.7 addressed one critical and several medium‑severity vulnerabilities identified by Anthropic’s open‑source software scanner. BTCPay has not confirmed whether the recent attacks exploited those specific flaws.
Earlier in the year, BTCPay warned of a critical vulnerability affecting all versions before 2.4.2 and encouraged users to update or shut down their servers. The project later offered a bounty for the recovery of stolen funds, capped at three BTC.
