TL;DR
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
BTCPay Server urged users to shut down their servers on Nov. 1 while it investigated reports that attackers had swept bitcoin from merchants’ hot wallets. Founder Nicolas Dorier said the reports appeared to involve releases older than version 2.4.2, but the project had not established how attackers gained administrator access or confirmed that newer versions were safe.
BTCPay Server urged users to shut down their servers on Sunday, Nov. 1, after receiving reports that attackers had moved bitcoin out of merchants’ internet-connected hot wallets. The open-source payment project said it was investigating; its founder later said the reports appeared to involve versions older than 2.4.2, while the method used to gain administrator access remained unknown.
In a post on X, the project said it was receiving reports of hot wallets on BTCPay servers being “swept by unauthorized attackers.” It asked anyone running an instance to stop it with the command ./btcpay-down.sh and leave it offline until the investigation was complete. A wallet being “swept” means its coins were moved out, according to the report.
About two hours later, founder Nicolas Dorier said the incidents appeared to involve releases older than version 2.4.2. He also said an attacker had logged in as an administrator on affected servers, an account with top-level access. Dorier did not identify how the attacker obtained those privileges. The project said its own public servers, which run version 2.4.7, had not been attacked; that statement does not establish that all newer installations are safe.
The project did not disclose a loss total, the number of affected servers, a confirmed cause or a fix in the cited statements. Its shutdown request was not limited to a particular version. Users were told to keep their instances off while the investigation continued.
Why Server Shutdowns Matter
The incident puts merchants who operate BTCPay servers in a difficult position: taking an instance offline can interrupt payment processing, but leaving a potentially compromised server running could expose funds held in its hot wallet. The project’s immediate advice was to stop the software while the team investigated, rather than wait for a confirmed vulnerability or patch.
BTCPay is designed so merchants can accept bitcoin directly into wallets they control, without a third-party payment custodian. That arrangement gives businesses control over their payment infrastructure, but also means each operator is responsible for protecting the server and its credentials. In a decentralized setup, the project cannot remotely shut down every merchant’s installation; each operator must act on the warning.
For users, the distinction between the affected-version reports and confirmed safety is important. Reports pointing to releases before 2.4.2 may help narrow the investigation, but the project had not said that updating alone would make every server safe. The reported administrator access also leaves open the possibility that exposure depended on individual server conditions, details that had not yet been established.
Products Worth Considering
Ledger Flex + Folio Crypto Hardware Wallet
Apple MacBook Air 15-inch (2026) with M5 chip, 16GB memory, 512GB SSD, Silver
Trezor Safe 7 Crypto Hardware Wallet
As an affiliate, we earn on qualifying purchases.
The Earlier 2.4.2 Security Fix
BTCPay Server is free, open-source software that businesses can install on their own computers or servers to accept bitcoin payments. Those installations run independently, rather than through a single BTCPay-controlled payment system. Merchants can configure hot wallets, which remain connected to the internet and can send funds using a seed phrase stored on the server.
BTCPay’s documentation warns that this setup carries security implications. It says the server can use a stored seed to sign and approve a payment, allowing the server to send coins without the merchant approving each transaction on a separate device. If an attacker gains control of the server or its credentials, that capability can create a path to the wallet’s funds.
The current reports follow a separate security incident disclosed in August. BTCPay said attackers had stolen funds through a flaw in versions before 2.4.2. The flaw exposed credential files for LND, software used to run a node on Lightning, a bitcoin payment network. BTCPay said it fixed that vulnerability in version 2.4.2. The report available on Nov. 1 did not establish whether the latest reports involved the same flaw or a different route to administrator access.
“We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers. If you’re running an instance, please shut it down (./btcpay-down.sh) until we complete the investigation.”
— BTCPay Server, in a post on X
Cause and Exposure Still Unknown
The project had not identified how attackers gained administrator access, how many servers were affected or how much bitcoin was taken. It had also not released a confirmed technical explanation, named a newly affected version range beyond Dorier’s initial description, or announced a fix for the latest reports.
It was not clear whether updating to 2.4.2 or later would address the current incidents, or whether there was a connection to the vulnerability fixed in August. Dorier’s report that the project’s own version 2.4.7 servers were not attacked is a limited observation, not a general assurance for users. The investigation was ongoing.
Awaiting Investigation Findings
BTCPay asked operators to keep their servers shut down until the investigation is complete. The next material update would need to clarify the access method, which installations were affected, whether a patch or other remediation is available, and what operators should do before restarting.
Until the project provides that guidance, the cited reports do not establish that every BTCPay server was compromised or that any particular version is broadly safe. Merchants may also need to account for payment interruptions while their instances remain offline. The source material did not give a timetable for the investigation or a date for a further update.
Key Questions
Why did BTCPay ask users to shut down their servers?
The project said it had received reports that unauthorized attackers were sweeping hot wallets on some BTCPay servers. It asked operators to stop their instances while it investigated.
Which BTCPay versions may be involved?
Founder Nicolas Dorier said the reports appeared to involve releases older than 2.4.2. The project had not confirmed that every installation on a newer version was safe.
Does BTCPay know how attackers got access?
Not yet, based on the cited statements. Dorier said an attacker had administrator access on affected servers, but the team had not determined how that access was obtained.
How much bitcoin was stolen, and how many servers were affected?
The project had not disclosed a loss amount or count of affected servers in the available report. Those details remained under investigation.
What should operators do now?
BTCPay’s stated instruction was to shut down the instance using ./btcpay-down.sh and leave it offline until the investigation is complete. The project had not provided a timetable for further guidance.
Source: coindesk.com
