BTCPay tells merchants to shut servers after reports of hot wallet drains
In brief
- BTCPay Server asked operators to shut down instances after reports of swept hot wallets.
- The attack vector BTCPay identified targets version 2.4.1 and older.
- BTCPay said it had no credible drain reports from users on the latest 2.4.7 release.
- BTCPay hasn't disclosed how many servers were affected or how much Bitcoin was taken.
What BTCPay said
The BTCPay Server project tweeted at 5:25 p.m. ET that it was receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers. It asked anyone running an instance to shut it down until the investigation was complete.
"If you're running an instance, please shut it down (./btcpay-down.sh) until we complete the investigation."
About two hours later, founder Nicolas Dorier said the reports appeared to involve releases older than version 2.4.2, and that the attacker had logged in to affected servers with administrator access. Later on Sunday, the project said it had identified an attack vector targeting version 2.4.1 (released July 23) or older. It said it had no credible reports of hot wallet drains for users running the latest 2.4.7 release.
Some hosting providers, including LunaNode, shut down BTCPay instances automatically to stop older versions from being exploited, according to the project. BTCPay urged everyone to keep their software updated and asked affected users to send details and logs to its security team.
Two numbers are still missing, though.
BTCPay hasn't said how many servers were affected or how much Bitcoin was taken.
Why hot wallets are exposed
BTCPay is self-hosted. Each merchant runs the software on their own server, and there's no central operator that can switch instances off. Merchants can choose to run a hot wallet, which stores the wallet's seed on that internet-connected server so it can sign transactions automatically. BTCPay's own documentation labels the feature "DANGER" and warns that it comes with security implications.
The second warning since August
The reports landed days after BTCPay released version 2.4.7 on Thursday as an emergency update fixing one critical and several medium-severity vulnerabilities. BTCPay said those flaws were surfaced through Anthropic's frontier open-source software scanner. It hasn't said whether the weekend attacks exploited any of them.
It's not the first time the project has told merchants to pull the plug. In August, BTCPay warned that a critical vulnerability in all versions before 2.4.2 was being actively exploited, and told users to update or shut down their servers. Supporters later funded a recovery bounty of 10% of any stolen funds returned (capped at 3 BTC).
Frequently asked questions
Which BTCPay Server versions are affected by the hot wallet attacks?
BTCPay said its investigation identified an attack vector targeting instances running version 2.4.1, released on July 23, or older. Founder Nicolas Dorier said the reports appeared to involve releases older than 2.4.2. The project said it had no credible reports of hot wallet drains for users on the latest 2.4.7 release.
Why can't BTCPay shut down vulnerable servers itself?
BTCPay is self-hosted, so each merchant runs the software on their own server and no central operator can switch instances off. That's why the project asked operators to shut down their own instances. Some hosting providers, including LunaNode, shut down BTCPay instances automatically.
What is a hot wallet in BTCPay Server?
A hot wallet is an optional feature that stores the wallet's seed on the merchant's internet-connected server so it can sign transactions automatically. BTCPay's own documentation labels the feature "DANGER" and warns that it comes with security implications.
