BTCPay Server, the free tool businesses use to accept bitcoin on their own servers, told users on Sunday to shut them down after reports of hot wallets being swept by unauthorised attackers.
The project’s message on X gave the command to stop the software and asked owners to leave it off until the investigation is complete. It gave no loss figure and no count of affected servers, and has not announced a fix.
About two hours later founder Nicolas Dorier said the reports “appear to involve” releases older than version 2.4.2. The project’s own public servers, running 2.4.7, were not attacked. He did not say whether newer versions are safe. Dorier also said the attacker logged in as an administrator on the servers that were hit. The team does not yet know how that access was obtained.
The design explains why the call was a plea. A hot wallet on a BTCPay server keeps its seed phrase on that server, so anyone who gets in can send the coins out. The documentation labels the feature “DANGER”. Because every merchant runs their own copy, there is no master switch, and BTCPay can only ask.
This is the second scare this year. In August the project confirmed that funds had been stolen through a flaw in versions before 2.4.2, which exposed credential files for Lightning nodes. That flaw was fixed in 2.4.2, the version now being named.
The open question is whether the affected servers never updated after August, or whether the administrator access came from somewhere that fix did not cover. The project has not said which.
