BTCPay Server operators instructed to shut down instances after hot wallet thefts

Multiple reports of hot wallets being drained from servers have prompted BTCPay Server, an open-source Bitcoin payment platform, to tell operators to deactivate their instances.

In a post on X, the project requested that anyone running an instance use its shutdown command to take it offline while the investigation continues. BTCPay has not yet disclosed the cause of the attack, the number of affected servers, or the amount stolen.

A hot wallet is a wallet whose private keys are stored on an internet-connected server, enabling automatic fund transfers, such as for refunds. This convenience also makes it a bigger target compared to offline storage. The incident involves software built around Bitcoin, not the Bitcoin network itself.

The warning follows two earlier security incidents at the project. On October 29, BTCPay released an emergency update, version 2.4.7, to fix one critical and several medium-risk vulnerabilities. In August, attackers exploited a separate flaw to steal Lightning Network credentials and drain nodes running behind BTCPay, including one operated by hardware wallet maker Foundation. At that time, BTCPay said its standard on-chain wallets, including hot wallets generated inside the software, were not compromised.

Thus, the new reports are notable because they involve wallet types that were not covered by the August vulnerability. BTCPay has not said whether these attacks are related to the flaws fixed last week.

Key developments to watch

Key questions include whether BTCPay ties the attacks to a specific software version and whether servers running the October 29 update were impacted. Loss figures and reports from named merchants will show the scale of the problem. In August, BTCPay narrowed the scope considerably after its first alert, so the initial warning may not reflect the final picture. Until BTCPay issues an all-clear, operators holding funds in a BTCPay hot wallet should follow its shutdown advice.