BTCPay Server warns users after hot-wallet theft reports
Key points
- BTCPay Server has urged operators to shut down their servers following reports of unauthorised Bitcoin wallet withdrawals.
- Preliminary findings point to attacks targeting installations running version 2.4.1 or earlier.
- The project has not confirmed total losses, affected server numbers or the precise attack method.
BTCPay Server has urged operators to shut down their instances after attackers reportedly drained connected Bitcoin hot wallets.
The warning followed reports of unauthorised transactions involving merchants’ internet-connected wallets on self-hosted payment servers.
“We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers,” the project said in an announcement on X.
The project’s founder, Nicolas Dorier, said preliminary findings pointed to releases older than version 2.4.2.
Dorier also reported that attackers gained administrator access, although investigators had not identified how they entered the affected servers.
BTCPay’s latest public servers run version 2.4.7, with the project reporting no confirmed attacks against those instances.
The open-source payment processor lets merchants host their own infrastructure, leaving individual operators responsible for securing their servers and wallets.
The incident leaves merchants facing an unresolved security investigation, with BTCPay asking operators to keep affected servers offline until further notice.
Frequently asked questions
More from Crypto
Circle details CCTP support for custom tokens
Bank of Korea surveys 31 firms on crypto risks
Israel extradites Nomad crypto theft suspect to US
Crypto industry spends $63 million targeting Sherrod Brown
THORChain halts ten networks after 10 ETH shortfall
Curve Finance launches on Stellar beyond EVM networks
