BTCPay Server, an open-source and free application utilized by companies to accept bitcoin transactions, advised its community on Sunday to turn off their servers.
This warning arrived after the team obtained information indicating that malicious actors were draining hot wallets on multiple servers.
Being an open-source platform, BTCPay Server permits any individual to install and operate the architecture on independent servers, which are computers maintaining continuous operation.
Because third-party intermediaries and custodians are absent, merchants acquire bitcoin directly into personal wallets, while BTCPay enables them to utilize these as hot wallets connected constantly to the internet.
Nevertheless, this transactional convenience introduces two distinct vulnerabilities.
The initial concern involves the hot wallet itself, residing on each individual merchant’s hardware. The wallet remains hot because the seed phrase, which is the private credential required to transfer funds, is held on that internet-linked machine. This same wallet can accept incoming payments without needing the seed.
Official documentation notes that BTCPay Server will subsequently apply the server-stored seed automatically to sign and validate transactions.
Consequently, a merchant’s server can autonomously dispatch funds externally without requiring authorization on a separate appliance. This setup offers convenience, but any unauthorized party breaching that server can redirect funds to their own destination. Documentation highlights this capability with a warning label reading DANGER, stating that it entails security implications.
The second vulnerability stems from decentralization, since every merchant hosts the software privately. Therefore, no central kill switch exists to halt operations during emergencies, leaving every business owner independently accountable for protecting their infrastructure.
This independence explains why BTCPay had to request shutdowns from individual server administrators directly, as the team cannot perform this action remotely.
As BTCPay stated on X: We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers. If you are running an instance, please shut it down (./btcpay-down.sh) until we complete the investigation.
A sweep implies that funds were extracted from a wallet simultaneously in a single movement. The command ./btcpay-down.sh terminates the application, and the platform urged operators to keep instances deactivated until the probe finishes.
BTCPay refrained from disclosing exact financial losses or the total count of impacted servers. Furthermore, no specific software versions were named, no patch was released immediately, and the shutdown directive applied broadly.
Roughly two hours later, project founder Nicolas Dorier shared additional details, noting that the reported thefts appear connected to BTCPay Server releases preceding version 2.4.2, meaning instances that have not upgraded to version 2.4.2 or newer.
While he did not confirm whether newer builds are entirely secure, he mentioned that the organization’s public servers, operating on version 2.4.7, experienced no attacks.
Dorier also reported that intruders gained entry by logging into compromised servers with administrator privileges, representing top-level access. Developers have not yet identified the vector used to obtain those credentials.
This incident marks the second major security scare this year.
BTCPay confirmed in August that malicious parties stole assets via a vulnerability affecting versions prior to 2.4.2. That security hole allowed outsiders to acquire credential files for LND, which is the software powering Lightning Network nodes for accelerated bitcoin payments. Armed with those files, attackers could manipulate the node and transfer funds, prompting a patch in version 2.4.2.
This latest alert follows a major Binance security breach on Thursday, wherein an exploiter extracted over $6 billion in digital assets, marking the largest security exploit in the history of the cryptocurrency sector.
Originally published at https://www.coindesk.com/tech/2026/11/02/btcpay-a-bitcoin-payment-tool-tells-users-to-switch-off-their-servers-after-reports-of-drained-wallets.
