BTCPay Server tells merchants to switch off their servers after attackers sweep bitcoin from hot wallets

BTCPay Server asked everyone running the software to switch it off on Sunday, November 1. "We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers," the project posted on X, asking operators to keep their instances down until its investigation is complete.

BTCPay is free, open-source software that shops and other businesses host on their own servers to take bitcoin payments directly, with no custodian in between. Some merchants run a hot wallet, where the seed phrase sits on the server so it can send payments without a separate approval, a feature BTCPay's documentation labels as dangerous, CoinDesk reported.

Founder Nicolas Dorier later said the reports appear to involve releases older than version 2.4.2, that the attacker logged in as an administrator, and that the project's own public servers, on version 2.4.7, were not attacked, according to CoinDesk. The team has not said how the attacker got in or confirmed that newer versions are safe. TokenPost reported that the project asked affected operators to install the current release and send logs to its security team.

BTCPay has not published a loss figure or a count of affected servers. In August, it fixed a separate flaw in versions before 2.4.2 that exposed Lightning node credentials.