BTCPay Server Urges Shutdowns After Hot Wallet Attack Reports

BTCPay Server urged operators to shut down their servers after receiving reports that unauthorized attackers were draining funds from hot wallets. The warning was issued on Sunday, with the project asking users to stop instances using a specific script. The attack vector affects older versions of the payment software, specifically version 2.4.1 or earlier. BTCPay Server has stated it has received no credible reports of hot wallet drains among users running the latest release, version 2.4.7.

The project previously warned operators to shut down server instances while investigating unauthorized wallet withdrawal reports. BTCPay Server has not disclosed the number of affected operators, the value of stolen funds, or technical details on how attackers accessed the wallets. Some hosting providers, including LunaNode, have shut down BTCPay instances automatically to stop older versions from being exploited.

BTCPay Server released version 2.4.7 on Thursday as an emergency update fixing one critical and several medium-severity vulnerabilities. In August, BTCPay warned that a critical vulnerability in all versions before 2.4.2 was being actively exploited. Supporters of the project funded a recovery bounty of 10% of any stolen funds returned, capped at 3 BTC.