BTCPay Server has issued an emergency warning to operators of its self-hosted Bitcoin payment processor after receiving reports that attackers were withdrawing funds from merchants' hot wallets. The project asked users to temporarily shut down their payment servers on November 1 while its team investigates the incidents.
The warning carries particular weight for businesses that rely on BTCPay Server to accept Bitcoin without going through a traditional payment intermediary, since each operator runs and secures their own installation.
Emergency guidance for operators
BTCPay Server is a free, self-hosted payment processor that lets merchants receive Bitcoin payments directly, with businesses managing their own servers and wallet configurations rather than depending on a centralized platform. That independence gives operators greater control, but it also places responsibility for software security on them individually.
In its November 1 notice, the project said unauthorized attackers were sweeping Bitcoin from hot wallets connected to certain installations. Operators were instructed to shut down their servers using the ./btcpay-down.sh command while the investigation continued.
Because BTCPay Server runs through independently managed installations, its developers cannot remotely disable every affected server, meaning a coordinated response depends on individual operators acting quickly.
Older versions identified as attack vector
The project's investigation subsequently identified an attack vector affecting version 2.4.1 and earlier. BTCPay Server also reported that it had received no credible reports of hot wallet drains involving its latest release, version 2.4.7.
That does not establish that every newer configuration is fully secure. BTCPay Server founder Nicolas Dorier indicated that attackers had gained administrator access to affected installations, though how that access was obtained remains under investigation.
The project released version 2.4.7 on October 29, shortly before the incidents became public. According to its official GitHub release notes, the update addresses 85 security findings, including one classified as critical and 13 rated high severity. The project has not publicly established that every reported wallet theft resulted from one of those specific vulnerabilities.
Why hot wallets draw scrutiny
The reported attacks highlight the difference between hot wallets and cold storage. Hot wallets remain connected to the internet, which makes them convenient for businesses processing payments regularly, but that same connectivity can create openings for attackers.
If someone obtains sufficient control over a server holding wallet credentials, they may be able to authorize unauthorized transactions. Cold storage reduces that exposure by keeping signing keys offline, leaving businesses that handle frequent Bitcoin transactions to balance convenience against security.
Earlier vulnerability adds to concern
The incident is not BTCPay Server's first security problem this year. In August, the project disclosed a vulnerability that allowed attackers to obtain administrative credentials associated with connected Lightning Network wallets. The weakness affected older installations and was addressed through version 2.4.2.
The latest investigation has again focused attention on installations that missed important security updates, though the project has not concluded that the November incidents used the same method. An earlier vulnerability and a newly reported attack may share affected software versions without sharing an identical cause.
What remains unconfirmed
BTCPay Server has not confirmed the total value of stolen Bitcoin or the number of compromised installations. Investigators are continuing to examine the incidents, including how attackers obtained administrator privileges.
- The total amount stolen has not been disclosed.
- The number of affected merchants remains unknown.
- The exact method attackers used to gain access is still under investigation.
The project has urged users to keep their software updated and has requested information from affected operators. For businesses running Bitcoin payment infrastructure, reviewing official security notices and following the project's recovery guidance remains a priority while a confirmed explanation of the attack, additional remediation instructions, and updates on stolen funds are awaited.
