- BTCPay Server urged operators to shut down their instances on Sunday after reports that attackers were sweeping hot wallets on servers running the software.
- The project later said the attack targeted versions 2.4.1 or older, and that it had no credible reports of drains among users running the latest 2.4.7 release.
- BTCPay released 2.4.7 on Thursday as an emergency update fixing one critical and several medium-severity vulnerabilities found by Anthropic’s scanner.
BTCPay Server, a free open-source tool for accepting Bitcoin payments, told operators to shut down their servers on Sunday after attackers began draining connected hot wallets, the project tweeted. Founder Nicolas Dorier later said the attacks appeared to involve releases older than version 2.4.2, with the intruder logging in using administrator access.
The project’s investigation identified an attack vector targeting instances running version 2.4.1 or older, according to a follow-up tweet. It emphasized that no credible hot wallet drains have been reported among users running the latest 2.4.7 release, urging everyone to keep software updated.
Some Hosting providers, including LunaNode, automatically shut down BTCPay instances to stop older versions from being exploited, the project noted. BTCPay has not disclosed how many servers were affected or how much Bitcoin was taken.
Because BTCPay is self-hosted, each merchant runs the software on their own server with no central operator to switch instances off. Hot wallets store the seed on the internet-connected server for automatic transaction signing, and the project’s documentation labels the feature “DANGER,” warning of security implications.
The attacks come days after BTCPay released version 2.4.7 on Thursday as an emergency update fixing one critical and several medium-severity vulnerabilities, which were identified via Anthropic’s open-source scanner. BTCPay has not confirmed whether the attacks exploited any of those flaws.
This is not the project’s first security scare this year. In August, BTCPay warned of an actively exploited critical vulnerability in all versions before 2.4.2, prompting users to update or shut down. Supporters later funded a recovery bounty offering 10% of any stolen funds returned, capped at 3 BTC.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
