BTCPay Server Issues Shutdown Warning After Attackers Empty Merchant Wallets

BTCPay Server has advised merchants to immediately suspend their payment operations following reports that attackers accessed vulnerable servers and transferred funds from connected hot wallets. The security incident has put merchants using version 2.4.1 or older releases on alert, while the project continues investigating the extent of the damage.

BTCPay Server is an open-source Bitcoin payment solution that allows businesses to process cryptocurrency transactions using self-managed infrastructure. Following reports of unauthorized hot wallet withdrawals, the platform issued an emergency notice asking operators to take their servers offline. Investigators subsequently identified outdated software installations as the primary focus of the security investigation.

At 04:07 UTC on Monday, the development team reported that the suspected attack targeted installations running version 2.4.1, released on July 23, and earlier versions. The project has not received credible reports of comparable wallet drains involving version 2.4.7. However, the total amount of cryptocurrency stolen and the number of affected merchant stores have not been disclosed.

The incident stands apart from last week’s Binance hack because the attackers did not compromise a centralized trading platform. Instead, they targeted businesses operating their own Bitcoin payment infrastructure, raising concerns about vulnerabilities in self-hosted cryptocurrency services.

Merchants are now looking for answers about their potential exposure and the precautions needed to protect their remaining funds.

BTCPay Server Hack: Attackers Exploit Older Installations

According to the preliminary investigation, attackers managed to obtain administrator access to outdated BTCPay Server installations before draining their associated hot wallets.

The project first published its emergency warning at 22:25 UTC on Sunday, instructing server operators to run its shutdown script and keep their instances offline until the investigation progressed.

Approximately two hours later, founder Nicolas Dorier confirmed that the project’s publicly accessible servers running version 2.4.7 had not been affected.

Dorier explained that the attackers had successfully logged in with administrator privileges on older installations, although investigators were still trying to establish how the unauthorized access occurred.

Hot wallets store private signing keys directly on payment servers, making it possible for merchants to process refunds and outgoing transactions automatically. However, this convenience also introduces security risks. Attackers who gain administrator control of a server may potentially obtain the ability to authorize cryptocurrency withdrawals.

Hosting companies responded quickly to the warning. BTCPay Server acknowledged LunaNode and other providers for independently taking vulnerable hosted installations offline. This precautionary response may have temporarily interrupted payment services for some merchants on Monday.

The software release history offers important context. Version 2.4.1 was released on July 23, followed by version 2.4.2 approximately two weeks later. That update addressed a critical vulnerability that the development team said was already being actively exploited.

Five subsequent releases brought the software to version 2.4.7, which arrived on Thursday. The latest version also addressed 85 security findings discovered through an AI-assisted security assessment performed by Anthropic for the project.

Investigators have not determined whether the current attack is connected to the vulnerability reported in August. Dorier has indicated that a detailed technical report will be published to explain the incident.

Are BTCPay Server Merchants Still at Risk?

Based on the findings disclosed so far, installations running version 2.4.1 or earlier are considered potentially exposed.

Dorier has attempted to reassure merchants who installed at least one update after version 2.4.2 was released, stating that the available information does not give them a reason to panic.

However, BTCPay Server operators should prioritize the following security steps:

Verify the software release: Merchants should immediately inspect their server versions. Installations running 2.4.1 or older should remain disconnected until the required security update is installed.

Upgrade to version 2.4.7: Administrators can access the update through Server Settings → Maintenance. Docker operators can execute the btcpay-update.sh script through SSH, while Umbrel and Start9 users can update through their respective application platforms.

Reduce hot wallet balances: Merchants should avoid storing large amounts of Bitcoin in wallets connected directly to their payment servers. Moving accumulated revenue into cold storage and maintaining only the liquidity required for refunds can help minimize potential losses.

Notify BTCPay Server security: Businesses that discover unauthorized withdrawals should submit incident details and relevant server logs to security@btcpayserver.org.

The reported incidents have involved hot wallets. Merchants using watch-only wallet arrangements maintain their private signing keys outside the payment server, providing an additional security separation.

Bitcoin Price Remains Relatively Unchanged After the Attack

Despite the security concerns surrounding BTCPay Server, Bitcoin showed little immediate movement following the announcement.

BTC was trading near $77,890 when the emergency warning was issued. By 07:40 UTC on Monday, the cryptocurrency had reached approximately $78,102 on Binance, representing a 0.3% increase over 24 hours.

The broader market was already dealing with the fallout from the previous week’s Binance hack, which had contributed to selling pressure across the cryptocurrency sector.

From a technical perspective, Bitcoin’s 200-day exponential moving average (EMA) remains an important support indicator. On October 30, BTC fell to approximately $76,326, moving close to the 200-day EMA near $76,512. Buyers have subsequently defended this level for three consecutive days.

Meanwhile, the 50-day EMA around $80,293 represents the next major resistance. Bitcoin also faces selling pressure near $81,971, the high recorded on October 29 before the Binance security incident.

For the bullish recovery to continue, BTC needs to maintain support above its 200-day EMA and regain the $80,000–$82,000 region. A successful move through these resistance levels could strengthen the recovery outlook, while another rejection may keep Bitcoin within its current trading range.