BTCPay Server tells merchants to shut down after reports of drained hot wallets
BTCPay Server told merchants on November 1 to shut down their instances after reports that attackers gained admin access and swept bitcoin from internet-connected hot wallets; the project has named no loss figure or fix.
BTCPay Server, the free, open-source tool businesses use to accept bitcoin directly, urged users on Sunday to switch off their instances while it investigates reports that attackers drained merchants' hot wallets, according to CoinDesk.
"We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers," the project wrote on X, per CoinDesk, telling anyone running an instance to shut it down with the ./btcpay-down.sh command and leave it off until the investigation concludes. "Swept" means the coins were moved out in a single transaction.
The shutdown request is a direct consequence of how BTCPay works. Because merchants self-host the software and hold their own keys, there is no central operator to pull a switch — each server owner has to act on their own box. The affected wallets are "hot" wallets: the seed phrase needed to spend funds sits on the internet-connected server, which BTCPay's own documentation says it will "automatically use… to sign" outgoing payments. That lets a server send coins without a separate approval step — and lets anyone who gains control of the server do the same. BTCPay's docs flag the feature with a "DANGER" label and warn it "comes with security implications."
About two hours after the alert, founder Nicolas Dorier added detail, per CoinDesk. The theft reports "appear to involve BTCPay Server releases older than version 2.4.2," he said. He did not say whether newer versions are safe, noting only that the project's own public servers — running version 2.4.7 — "were not attacked." Dorier said attackers logged in with administrator-level access, but that the team does not yet know how they obtained it.
As of CoinDesk's report, BTCPay had not specified a loss amount, a count of affected servers, or a fix, and its shutdown call was not limited to any single version.
Key facts
- BTCPay Server asked all users to shut down instances via
./btcpay-down.shpending investigation — BTCPay on X, via CoinDesk. - Reports "appear to involve" releases older than 2.4.2; project's own servers on 2.4.7 were not hit — founder Nicolas Dorier, via CoinDesk.
- Attackers gained administrator access; method unknown — Dorier, via CoinDesk.
- No loss figure, affected-server count, or fix disclosed as of November 2 — CoinDesk.
- Prior incident: in August, BTCPay confirmed thefts via a flaw in pre-2.4.2 versions that exposed LND credential files, fixed in 2.4.2 — CoinDesk.
The real-world read
What BTCPay has confirmed is thin, and it says so: no loss figure, no server count, no confirmed cause, and — notably — no assurance that updated versions are safe. "Older than 2.4.2" is where the August flaw lived too, which could mean unpatched servers are being picked off again, or something new. Dorier's one data point is that his own 2.4.7 servers survived — reassuring but not proof. The honest takeaway: this is an unresolved, active incident, and the only concrete instruction so far is to pull the plug.
Opinion, and whose
No forecasts or verdicts have been offered on record. Dorier's framing that newer releases may be unaffected is his read, not a cleared finding.
Sources
- CoinDesk (Tier 2, secondary) — the report, citing BTCPay's and Dorier's X statements and BTCPay's own documentation. No marketing material involved.
This is news reporting, not financial or security advice.