BTCPay Tells Merchants to Switch Off Servers Amid Hot Wallet Attacks

Operators of btcpay server software received urgent instructions to deactivate their systems on Sunday after reports emerged that attackers were emptying connected hot wallets. The project issued a shutdown command via social media, advising users to halt their instances while investigations were carried out.

Founder Nicolas Dorier indicated that the incidents appeared to affect software versions prior to 2.4.2, noting that unauthorized parties had gained administrator access to the compromised setups. Later findings from the development team pointed to an attack vector impacting instances running version 2.4.1 or older releases. No credible incidents have been reported among users operating the recent 2.4.7 update.

Protecting Your btcpay Server

Because the platform is self-hosted, merchants operate the software independently on their own infrastructure without a central authority capable of remote shutdowns. Some hosting providers automatically deactivated instances to prevent older installations from being compromised. The software documentation previously cautioned that utilizing internet-connected hot wallets carries inherent security risks.

The warning follows an emergency update released days prior to address critical vulnerabilities identified through an open-source software scanner. The project previously encountered security concerns earlier in the year when older software versions faced active exploitation.

Shut down vulnerable btcpay server instances immediately to prevent unauthorized hot wallet drains.

Why it matters

The security advisory directly impacts merchants utilizing self-hosted Bitcoin payment infrastructure, requiring immediate administrative intervention to protect funds. Software operators must apply updates promptly to mitigate exposure to active attack vectors targeting older installations.