BTCPay Server urges shutdown of merchant instances amid hot wallet drain reports

Traders Union
All News
Crypto
BTCPay Server merchant alert

Highlights

BTCPay Server advised all users to shut down merchant instances on June 2 after reports of unauthorized hot wallet drains affecting self-hosted servers.
Founder Nicolas Dorier indicated that affected systems appear to be running releases prior to version 2.4.2 and accessed via administrator-level logins, while version 2.4.7 public servers were not attacked.
The incident underscores operational risks for businesses relying on self-custodied payment infrastructure, where rapid breach response depends entirely on individual server operators.

Shutdown alert and versions under review

As reported by CoinDesk, BTCPay Server told users on Sunday to shut down their instances after receiving reports of unauthorized attackers sweeping hot wallets on some servers. The software, which businesses use to accept bitcoin payments directly into their own wallets, is typically deployed on merchants’ own infrastructure rather than through a central operator.

Because BTCPay is open-source and self-hosted, each merchant is responsible for securing its own server. The project said there is no central control that allows it to remotely switch off affected systems, which is why it asked every server owner to take action individually.

In a post on X, BTCPay said users should keep servers offline until the investigation is complete. The project did not provide a loss figure, identify how many servers may have been affected, specify vulnerable versions in its initial warning, or announce a remediation path.

About two hours later, founder Nicolas Dorier said the reports appear to involve releases older than version 2.4.2. He did not say newer versions are confirmed safe, but said the project’s own public servers running version 2.4.7 were not attacked, and added that the compromised systems appear to have been accessed through administrator-level logins.

Security implications for self-hosted crypto payments

BTCPay’s architecture gives merchants direct control of bitcoin payments, but that model also leaves sensitive wallet credentials on internet-connected systems when hot wallets are enabled. Its documentation says the server can automatically use the stored seed phrase to sign transactions, making server security critical to preventing unauthorized fund transfers.

The latest incident also revives concerns from August, when BTCPay confirmed theft tied to a flaw in versions before 2.4.2. In that earlier case, attackers were able to obtain credential files for LND, software used to run Lightning Network nodes, and use them to control nodes and move funds. BTCPay said that issue was fixed in version 2.4.2.

For businesses using self-custodied payment infrastructure, the warning highlights the operational trade-off between decentralization and incident response. Without a third-party custodian or centralized kill switch, any breach response depends on how quickly individual operators can secure or disconnect their own systems.

Our earlier report on Q3 cybersecurity funding trends highlighted that global cybersecurity and privacy startups raised $6.8 billion, with fewer deals but much larger late-stage rounds. We also noted that identity security and AI-focused security companies attracted the most investor attention, alongside active M&A as larger players moved to strengthen fraud and risk defenses.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.