Hackers Drain Bitcoin Hot Wallets on BTCPay Servers, Users Urged to Shut Down Immediately

BTCPay Server, a popular open-source payment processor, has issued an urgent warning to its users after receiving reports of attackers draining Bitcoin hot wallets hosted on its servers. The project has instructed all operators to immediately shut down their installations and keep them offline pending a thorough investigation into the security incident.

In a security notice posted on November 1st, the BTCPay Server team stated, "We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers." To mitigate further potential losses, operators were advised to execute the command ./btcpay-down.sh and maintain the shutdown status until the investigation concludes. The warning did not specify any safe version or indicate when it would be safe to restart services.

Early findings from the investigation suggest that affected servers were running outdated versions of the software, specifically prior to version 2.4.2. Reports indicate that attackers gained administrator access to these compromised installations. However, the initial entry vector or the method by which attackers achieved administrative privileges remains unconfirmed, leaving the exact cause of the breach under active scrutiny.

Nicolas Dorier, a founder of BTCPay Server, reportedly noted that the project's own public servers, running the more recent version 2.4.7, had not been targeted. While this observation is significant, it does not guarantee the security of all updated installations, and the broader shutdown recommendation remains in effect as a precautionary measure.

The full extent of the damage, including the total amount of Bitcoin stolen and the number of affected installations, has not yet been disclosed. The lack of a confirmed technical account detailing the attackers' methods—whether through stolen credentials, a software vulnerability, or another exploit—hinders immediate remediation efforts for affected users.

BTCPay Server's architecture allows merchants to accept Bitcoin directly through self-hosted software. A key feature is its hot wallet functionality, which signs transactions using a seed stored directly on the server, offering convenience but also posing a risk if the server is compromised. This incident underscores the inherent risks associated with storing sensitive signing material within an online environment.

The security alert follows the recent release of BTCPay Server version 2.4.7 on October 29th, which addressed numerous security findings, including one critical vulnerability. However, there is currently no confirmed link between these patches and the ongoing wallet drain incidents. Previous advisories, such as one concerning exposed Lightning Network Daemon credentials for version 2.4.2, are distinct and do not appear to be related to the current compromise.

For now, the most critical action for operators is to follow the official directive: shut down affected servers using ./btcpay-down.sh and await further guidance from the BTCPay Server team. Updating the software alone is not presented as a solution to an active compromise, and users are urged to distinguish official instructions from community speculation as the investigation progresses.