BTCPay Tells Merchants to Switch Off Servers Amid Hot Wallet Attack Reports

In brief

• BTCPay Server urged operators to shut down their instances on Sunday after reports that attackers were sweeping hot wallets on servers running the software.
• The project later said the attack targeted versions 2.4.1 or older, and that it had no credible reports of drains among users running the latest 2.4.7 release.
• BTCPay released 2.4.7 on Thursday as an emergency update fixing one critical and several medium-severity vulnerabilities found by Anthropic's scanner.

BTCPay Server, a free, open-source tool businesses use to accept Bitcoin payments, told operators to switch off their servers on Sunday after reports that attackers were draining the hot wallets connected to them.

"We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers," the project tweeted at 5:25 p.m. ET. "If you're running an instance, please shut it down (./btcpay-down.sh) until we complete the investigation."

About two hours later, BTCPay founder Nicolas Dorier said the reports appeared to involve releases older than version 2.4.2, and that the attacker had logged in to affected servers with administrator access.

Later on Sunday, the project said its investigation had identified an attack vector targeting instances running version 2.4.1, released on July 23, or older. "We have no credible reports of hot wallet drains for users running the latest 2.4.7 release," it said, urging everyone to keep their software updated and asking affected users to send details and logs to its security team.