CoinDesk
BTCPay Server urged users to shut down their instances after reports that attackers drained bitcoin from merchants’ internet-connected hot wallets. The project has not disclosed losses or affected-server counts, announced a fix, or confirmed newer versions are safe. Founder Nicolas Dorier said the reports appear to involve releases older than 2.4.2, and attackers logged in with administrator access; investigators do not yet know how they obtained it.
Why it matters
BTCPay is open-source software that businesses run on their own servers to accept bitcoin payments directly, without a third-party custodian. That model gives merchants control, but it also means each operator must secure and shut down their own system. The project cannot disable every affected instance centrally.
The reported risk centers on hot wallets, whose seed phrases are stored on internet-connected servers. BTCPay’s documentation says the software can use a stored seed to sign payments automatically. If an attacker takes control of a server, that capability can put funds at risk without a separate approval from the merchant.
Market impact
The shutdown warning applies while the investigation continues, not only to a specified software version. Dorier said BTCPay’s public servers, running version 2.4.7, were not attacked, but did not confirm that newer releases are safe.
The alert follows a separate August incident involving versions before 2.4.2, where a flaw exposed LND credential files. BTCPay fixed that issue in 2.4.2. Whether the current reports involve the same vulnerability is not established. Merchants using BTCPay face uncertainty until the project identifies the cause and provides clear guidance.
Frequently asked questions
-
Why did BTCPay Server ask operators to shut down their instances?
The project received reports that attackers were draining bitcoin from merchants’ internet-connected hot wallets and asked operators to shut down while it investigates.
-
Which BTCPay Server versions do the reports appear to involve?
Founder Nicolas Dorier said the reports appear to involve releases older than version 2.4.2. The project has not confirmed that newer versions are safe.
-
How could a compromised server put a BTCPay hot wallet at risk?
A hot wallet’s seed phrase is stored on an internet-connected server. BTCPay can use that stored seed to sign payments automatically, so control of the server can put wallet funds at risk.
-
Does BTCPay know how attackers gained access?
No. Dorier said attackers logged in with administrator access, but the team has not determined how they obtained it.
-
How is the current alert related to the earlier BTCPay incident?
In August, attackers stole funds through a flaw in versions before 2.4.2 that exposed LND credential files. BTCPay fixed that flaw, but has not established whether the current reports involve the same cause.
TheBlock
Lookonchain
WuBlockchain
CryptoSlate