BTCPay Server, an open-source Bitcoin payment processor, instructed merchants to shut down their self-hosted instances on Sunday following reports that attackers were draining hot wallets connected to servers running the software. The project stated it was receiving credible reports of unauthorized access leading to fund theft and advised operators to execute a shutdown script until its investigation concluded.
Subsequent analysis by BTCPay founder Nicolas Dorier indicated the attacks targeted versions older than 2.4.2, with intruders gaining administrator access. The project later confirmed the vulnerability affected instances running version 2.4.1 or earlier, noting no credible reports of drains among users on the latest 2.4.7 release. Hosting providers such as LunaNode automatically disabled older instances to mitigate risk. BTCPay has not disclosed the number of affected servers or the total amount of Bitcoin stolen.
This incident follows the emergency release of version 2.4.7 on Thursday, which patched one critical and several medium-severity vulnerabilities identified by Anthropic’s scanner. It marks the second security scare for BTCPay in recent months; in August, the project warned of an actively exploited flaw in versions prior to 2.4.2 and offered a recovery bounty capped at 3 BTC.
The incident highlights the inherent operational risks associated with self-hosted cryptocurrency infrastructure, where security responsibility rests entirely with individual merchants rather than a centralized provider. By urging immediate server shutdowns, BTCPay acknowledged the severity of the threat but also exposed the fragility of hot wallet configurations, which store private keys on internet-connected servers despite explicit warnings in official documentation. The lack of transparency regarding the scale of losses underscores the difficulty in assessing systemic impact when incidents are distributed across decentralized nodes.
From a Compliance and Credibility perspective, this event raises questions about the efficacy of rapid patch deployment versus user adoption rates. Although BTCPay released an emergency update days before the attack, the exploitation of older versions suggests a lag in merchant maintenance practices. This gap between vulnerability disclosure and actual remediation creates a window of opportunity for attackers, potentially eroding trust in the platform's ability to protect funds even after technical fixes are available. Merchants relying on automated hosting solutions may have been safer, indicating a structural advantage for managed services over pure self-hosting models.
