BTCPay Server has issued an urgent alert following reports that attackers were draining Bitcoin hot wallets on its servers This article explores btcpay server issued. . The open-source payment processor advised operators to immediately shut down their installations and keep them offline while its team investigates the thefts.
In its November 1 security notice, the project stated: "We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers." It instructed operators to run ./btcpay-down.sh until the investigation is complete.
Founder Nicolas Dorier reported that affected servers were running versions older than 2.4.2, with attackers potentially gaining unauthorized access as administrators. No complete technical account has established whether the attackers used stolen login details, a software flaw, or another route to administrator access. This makes payments easy, but it places sensitive signing material in an online environment, making a server breach a significant risk.
A server breach could jeopardize funds, as highlighted by ZeroOwl's reports on fake crypto wallet screens stealing recovery phrases and Google Sheets campaigns that swap wallet addresses. The official release notes of BTCPay Server 2.4.7 list 85 security findings, addressing issues such as permissions, authentication, payment handling, and other functionalities. Operators must distinguish between confirmed developer instructions and community reports as the investigation progresses and the team determines the attack path, affected deployments, and recovery steps.
[x]
