An Urgent, No-Caveats Warning

BTCPay Server, the widely used open-source platform that lets merchants accept Bitcoin payments through self-hosted infrastructure, issued an emergency warning on November 1 after receiving multiple reports of hot wallets being drained by unauthorized attackers. The project’s instruction to operators was blunt: shut your instance down now, and keep it offline until the investigation concludes.

In its notice, the BTCPay Server team wrote that it was “receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers,” and told anyone running an instance to execute the ./btcpay-down.sh script immediately. Notably, the warning was not scoped to any particular version range, and the project did not say when, or under what conditions, it would be safe to bring a server back online.

What’s Known So Far — and What Isn’t

Early signals point toward outdated software as a contributing factor. BTCPay Server founder Nicolas Dorier reportedly indicated that the affected servers identified so far were running versions older than 2.4.2, and that the attackers had somehow authenticated as administrators on those systems. Crucially, investigators have not yet established how the attackers obtained that administrator-level access — whether through stolen credentials, a software vulnerability, or some other route remains an open question.

Dorier also noted that the project’s own public-facing servers, which run version 2.4.7, had not been targeted. That’s a useful data point, but operators shouldn’t read it as a clean bill of health for every up-to-date deployment; the shutdown guidance applies broadly while the investigation is ongoing, and no complete technical writeup has yet confirmed whether current versions are entirely immune.

No confirmed total for stolen funds or count of affected servers has been published. Until BTCPay’s team publishes a fuller technical account, the specific mechanism attackers used to reach administrator-level control remains unconfirmed.

Why Hot Wallets Make This So Dangerous

BTCPay’s hot wallet feature is designed for convenience: when enabled, it signs Bitcoin transactions automatically using a seed phrase stored directly on the server, rather than requiring a merchant to manually approve every payout from cold storage. That convenience comes at a cost — if an attacker gains sufficient control of the server, the signing material needed to move funds is sitting right there, online and reachable.

The incident echoes a broader pattern Secure Bulletin has tracked in cryptocurrency security: fake wallet interfaces designed to steal recovery phrases, and campaigns that quietly swap destination wallet addresses inside spreadsheets and other documents. Those specific campaigns have not been linked to the BTCPay thefts, but they underline the same underlying lesson — once wallet secrets or signing authority are exposed to a compromised environment, funds are at risk.

A Recent Patch Cycle, With No Confirmed Connection

The timing invites an obvious question: does this tie back to BTCPay Server 2.4.7, released just three days earlier on October 29? That release’s official notes list 85 security findings addressed following reports from Anthropic’s OSS Scanner program — one critical, 13 high, 52 medium, and 19 low-severity issues spanning permissions, authentication, and payment-handling logic.

However, there is currently no confirmed link between those fixes and the active wallet drains. A separate, earlier advisory tied to version 2.4.2 concerned exposed Lightning Network Daemon credentials, and BTCPay explicitly stated at the time that its on-chain wallets — hot wallets included — were not affected by that particular issue. Conflating the two incidents would overstate what has actually been confirmed.

What Operators Should Do

• Run ./btcpay-down.sh immediately on any self-hosted BTCPay Server instance and keep it offline pending further guidance from the project.
• Do not treat updating alone as a fix for an active compromise — if a server has already been breached, patching does not undo administrator-level access an attacker may retain.
• Monitor official BTCPay Server channels for confirmed developer guidance, and be cautious about treating unverified community reports as authoritative.
• Where hot wallets are used, weigh the operational convenience against the exposure of having signing material resident on an internet-facing server.

Secure Bulletin will update this story as BTCPay Server’s investigation clarifies the attack path, the scope of affected deployments, and recommended recovery steps.