BTCPay Urges Merchants to Replace Wallets After $1.6M Theft

BTCPay Server has instructed merchants to rebuild outdated payment servers and swap out their wallets after malicious actors drained approximately $1.6 million in digital assets. The open-source payment software provider issued a security advisory warning that simply applying the latest software updates might not secure funds if unauthorized access to a server was already established by attackers.

The security alert addresses vulnerabilities affecting installations running version 2.4.1 or older. According to blockchain analytics provider Bitquery, approximately $1.63 million in suspected thefts took place across 682 wallet sweeps between October 30 and November 2. The stolen funds comprised 18.38 Bitcoin and 3,405 Litecoin. Investigators noted that 87 percent of these funds moved during an eight-hour window on November 1.

BTCPay acknowledged it regrets not reaching operators running older versions sooner after an initial security advisory was published in August. Despite public warnings to shut down vulnerable systems, unauthorized wallet sweeps continued overnight. Bitquery recorded an additional 267 sweeps valued at roughly $150,000 following a warning issued on November 1.

BTCPay Server urges merchants to migrate to entirely new servers and replace compromised wallets.

To mitigate ongoing risks, BTCPay recommends that operators who previously ran vulnerable versions migrate entirely to new server setups, even if they have already updated their software or see no missing funds. Attackers who gained administrative privileges may hold credentials or wallet secrets that remain valid even after the core vulnerability is patched. Operators are advised to generate new wallets using fresh seed phrases on secure devices, retire old virtual machines, and replace exposed hosting passwords, SSH credentials, and API keys.

BTCPay confirmed that servers running version 2.4.2 or later experienced no impact from the intrusions. Furthermore, wallets utilizing external spending keys, such as hardware wallets, remained unaffected by the reported security breaches.

Why it matters

This security incident highlights the critical need for comprehensive server migration and credential rotation following administrative compromises in self-hosted payment infrastructure. Merchants utilizing btcpay server must take proactive measures to secure their operations against persistent unauthorized access.