BTCPay Tells Merchants to Switch Off Servers Amid Hot Wallet Attack Reports

BTCPay Server, a free, open-source tool businesses use to accept Bitcoin payments, told operators to switch off their servers on Sunday after reports that attackers were draining the hot wallets connected to them.

“We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers,” the project tweeted at 5:25 p.m. ET. “If you’re running an instance, please shut it down (./btcpay-down.sh) until we complete the investigation.”

About two hours later, BTCPay founder Nicolas Dorier said the reports appeared to involve releases older than version 2.4.2, and that the attacker had logged in to affected servers with administrator access.

Later on Sunday, the project said its investigation had identified an attack vector targeting instances running version 2.4.1, released on July 23, or older. “We have no credible reports of hot wallet drains for users running the latest 2.4.7 release,” it said, urging everyone to keep their software updated and asking affected users to send details and logs to its security team.

Some hosting providers, including LunaNode, have shut down BTCPay instances automatically to stop older versions from being exploited, the project said. BTCPay has not said how many servers were affected or how much Bitcoin was taken.

Hot wallets and BTCPay’s emergency update

Because BTCPay is self-hosted, each merchant runs the software on their own server, and there is no central operator that can switch instances off. Merchants can choose to run a hot wallet, which stores the wallet’s seed on that internet-connected server so it can sign transactions automatically. BTCPay’s own documentation labels the feature “DANGER” and warns that it “comes with security implications.”

BitcoinBTC · USD

$77,288−3.38%

24H7D1M1YYTD

Oct 26Oct 28Oct 30Nov 1Nov 2

$81.8k$80.1k$78.4k$76.7k

24h HighHigh$78,728

24h LowLow$77,236

VolVol$897.0M

→

$50$100$500

Buy

The attacks come days after BTCPay released version 2.4.7 on Thursday as an emergency update fixing one critical and several medium-severity vulnerabilities, which it said were brought to its attention through Anthropic’s frontier open-source software scanner. BTCPay has not said whether the attacks exploited any of those flaws.

It is not the first security scare for the project this year. In August, BTCPay warned that a critical vulnerability in all versions before 2.4.2 was being actively exploited, and told users to update or shut down their servers. Supporters of the project later funded a recovery bounty of 10% of any stolen funds returned, capped at 3 BTC.