A wave of thefts targeting Bitcoin hot wallets hosted on BTCPay Server has prompted an urgent warning from its development team. Users have been instructed to shut down their servers immediately — using the command ./btcpay-down.sh — and leave them offline while the investigation into what’s draining funds is underway.
The alert, issued on November 1, sprang from multiple reports that hackers were “sweeping” hot wallets on compromised BTCPay Servers, taking full control and funneling funds out. Administrators of affected installations appear to be logging in with administrative access, but the initial breach method remains unclear. The warning applies across installations; BTCPay hasn’t yet claimed that merely updating to later versions is sufficient to prevent or contain the thefts.
Outdated Servers in the Crosshairs
Founder Nicolas Dorier has identified that many of the impacted servers are running versions older than 2.4.2, which evidently present greater vulnerability. Public servers using version 2.4.7 have, so far, avoided reported attacks — a promising sign, but not confirmation that newer versions are completely secure. The advisory echoes the seriousness of the situation, emphasizing that any BTCPay Server operator must treat the overall shutdown order as the top priority, regardless of their version.
Details remain sparse: there are no confirmed totals for how much Bitcoin has been stolen, how many servers are affected, or whether attackers exploited stolen credentials, software bugs, or some other weakness. Even the precise entry vector for gaining administrative privileges has not yet been identified.
Hot Wallets & Recent Updates
BTCPay Server allows merchants to run hot wallets, which store the seed used to sign on-chain transactions directly on the server software. While this arrangement improves convenience, it also means that any exploit granting sufficient server access can endanger real funds.
On October 29, BTCPay released version 2.4.7, which addressed 85 security issues raised by Anthropic’s OSS Scanner program. These fixes included one critical, 13 high, 52 medium, and 19 low-severity issues spanning permissions, authentication challenges, and payment-handling vulnerabilities. It’s not yet known whether this latest patch intersects with the red-hot wallet drains. Notably, an earlier advisory for version 2.4.2 dealt with exposed Lightning Network Daemon credentials but explicitly excluded on-chain or hot wallets from its impact.
For now, the safest course advised by BTCPay is to halt all server operations until more information emerges. Updates alone are not presented as a guaranteed cure. Operators should remain alert for further guidance, distinguish confirmed instructions from rumors, and verify the security status of their specific deployment.
What this means: This incident underscores a core tension in crypto infrastructure between convenience and security. Hot wallets, by design, make on-chain transactions easier, but they also magnify risk when attackers gain control. Maintaining up-to-date software is critical, but so is understanding that patches may lag behind exploitation. The coming days should reveal whether one or more vectors (old versions, credential leaks, or auth flaws) were responsible. Operators need to watch BTCPay’s ongoing updates carefully, audit their version history, and treat the shutdown notice seriously until official all-clear signals are given.
