BTCPay tells merchants to shut down servers after attacks
BTCPay Server urged operators to switch off their instances after reports that attackers were sweeping hot wallets on servers running older versions of the software.
The facts
- According to Decrypt, BTCPay Server told operators on Sunday to shut down their instances after reports that unauthorised attackers were sweeping hot wallets.
- The project later said the attack vector targeted version 2.4.1 (released on July 23) or older, and that it had no credible reports of drains among users on the latest 2.4.7 release.
- BTCPay has not said how many servers were affected or how much Bitcoin was taken, and it has not said whether the attacks used the flaws fixed in 2.4.7.
- Some hosting providers, including LunaNode, have shut down older BTCPay instances automatically, according to the project.
Case notes · Danny's take
Why it matters
BTCPay is self-hosted. There is no central operator who can pull the plug, so every merchant is their own security team. That is the trade-off with open-source payment tools: no middleman to trust, but nobody to patch for you either. This is also the second scare this year, and it hits the same old-version problem. Skipped updates are where the crime scene starts.
For traders
Watch whether BTCPay or on-chain researchers publish the attacker addresses and the amounts moved. Until then, treat any loss figure you see on social media as unconfirmed.
For builders
If you run BTCPay, update to 2.4.7 or later and check your logs for unexpected admin logins. Ask yourself whether you really need a hot wallet on an internet-connected server, because the project's own documentation labels that feature "DANGER".
Not financial advice. Do your own investigation.
This story was summarised with AI from Decrypt's reporting and checked against our editorial policy. Danny's take reflects his views. Disclaimer.
Danny Walter
Founder of Moon Republic, Volt Terminal and Moon Republic Academy. Author of The Market Is a Crime Scene and After the Applause.