BTCPay, a bitcoin payment tool, tells users to switch off their servers after reports of drained wallets

BTCPay Server, a free, open-source tool for businesses to accept bitcoin payments, issued an urgent alert on Sunday asking users to shut down their servers. The request came after the project received reports that attackers were draining "hot wallets" on some of those servers. As open-source software, BTCPay allows anyone to deploy and run the system on their own servers, with businesses receiving bitcoin payments directly into their own wallets.

The platform's documentation highlights the security implications of its hot wallet feature, which automatically uses a seed phrase stored on a server to sign payments. While this convenience allows merchants to transact without separate approval, it also means anyone who breaks into the server can send coins to their own address. The documentation explicitly marks this feature with a "DANGER" label.

Investigation Details

BTCPay did not specify the amount stolen or the number of affected servers in its initial alert. The company issued a shutdown command (./btcpay-down.sh) that stops the software, asking owners to leave it off until the investigation is complete. We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers. If you're running an instance, please shut it down until we complete the investigation, BTCPay said on X.

Version Vulnerability

About two hours after the initial alert, BTCPay founder Nicolas Dorier provided more information, stating that the theft reports "appear to involve BTCPay Server releases older than version 2.4.2." He confirmed that the attacker logged in as an administrator on compromised servers but said the team does not yet know how the attacker gained these credentials. Dorier noted that BTCPay's own public servers, running version 2.4.7, "were not attacked."

This incident follows a similar security issue in August 2026, where attackers stole funds through a flaw in versions before 2.4.2. The vulnerability allowed outsiders to grab credential files for LND software, which runs a node on Lightning, a faster payments network built on bitcoin. BTCPay addressed that issue in version 2.4.2. The latest incident also comes just days after Binance experienced the largest exploit in crypto history, with an attacker draining cryptocurrencies worth over $6 billion.