Hackers Drain Bitcoin Hot Wallets on BTCPay Servers, Users Urged to Shut Down Immediately

BTCPay Server has issued an urgent warning after receiving reports that attackers were draining Bitcoin hot wallets on its servers. The open-source payment processor told operators to shut down their installations immediately and keep them offline while its team investigates the thefts. The alert raises concerns for merchants holding funds in wallets managed through affected servers.

In its November 1 security notice, the project said: “We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers.” It instructed operators to run ./btcpay-down.sh until the investigation is complete. The warning did not limit that instruction to specific software versions or announce that restarting was safe.

BTCPay Server Warns

Early findings point toward outdated installations. Founder Nicolas Dorier reportedly said affected servers were running versions older than 2.4.2 and that attackers had logged in as administrators. However, investigators had not established how they gained that access, leaving the initial entry point unconfirmed.

Dorier also said the project’s public servers running version 2.4.7 had not been attacked. That observation is important, but it does not prove every updated installation is safe. Operators should not treat the absence of reported attacks against those servers as an all-clear while the broader shutdown warning remains in place.

The available reports did not provide a confirmed loss total or a count of affected installations. No complete technical account has established whether the attackers used stolen login details, a software flaw, or another route to administrator access.

BTCPay Server lets merchants accept Bitcoin directly using self-hosted software. Its wallet documentation explains that an enabled hot wallet signs transactions using a seed stored on the server. This makes payments convenient, but places sensitive signing material inside the online environment. A server breach can therefore put funds at risk, depending on the access obtained.

The incident highlights risks also covered in Cyber Security News reporting on fake crypto wallet screens stealing recovery phrases and Google Sheets campaigns that swap wallet addresses. Those campaigns involve different methods, and neither has been linked to the BTCPay thefts. The shared concern is protecting wallet secrets and checking where funds are sent.

Recent Patches Do Not Confirm the Cause

The warning follows BTCPay Server 2.4.7, released October 29. Its official release notes list 85 security findings addressed after reports from Anthropic’s OSS Scanner program. These included one critical, 13 high, 52 medium, and 19 low-severity findings, covering permissions, authentication, payment handling, and other functions.

There is no confirmed link between those fixes and the current wallet drains. A separate earlier advisory for version 2.4.2 concerned exposed Lightning Network Daemon credentials. BTCPay explicitly said its own on-chain wallets, including hot wallets, were not affected by that earlier issue. Combining the two incidents would misstate what developers have confirmed.

For now, the clearest official action is to stop the server with ./btcpay-down.sh and leave it offline pending further guidance. Updating alone should not be presented as resolving an active compromise. Operators also need to distinguish confirmed developer instructions from community reports as the investigation develops and the team determines the attack path, affected deployments, and recovery steps.[x]

The post Hackers Drain Bitcoin Hot Wallets on BTCPay Servers, Users Urged to Shut Down Immediately appeared first on Cyber Security News.