- A widely used bitcoin payment tool hit the kill switch. BTCPay Server, a free, open-source tool businesses use to accept bitcoin payments, urged users on Sunday to shut down their servers after reports that attackers were sweeping “hot wallets” on some instances.
- The scope is still unknown. BTCPay gave no loss figure or count of affected servers and announced no fix, though founder Nicolas Dorier said about two hours later that the reports “appear to involve BTCPay Server releases older than version 2.4.2,” and that the project’s own public servers on version 2.4.7 “were not attacked.”
- Attackers had top-level access. Dorier said an attacker logged in as an administrator on the affected servers, but the team does not yet know how that access was obtained, and it has not said whether newer versions are safe.
- It is the latest in a run of security shocks. In August, BTCPay confirmed attackers stole funds through a flaw in versions before 2.4.2 that exposed Lightning node credentials, and the new alert follows Thursday’s Binance hack of more than $6 billion, the largest exploit in crypto history.
What Happened?
“We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers. If you’re running an instance, please shut it down (./btcpay-down.sh) until we complete the investigation,” BTCPay said on X. Because the software is self-hosted, each merchant runs it on their own server and receives payments directly into their own wallets, with no central custodian. That also means there is no master switch, so the project had to ask every server owner to shut down individually.
Why It Matters?
The incident highlights the trade-off between convenience and security in self-custody payments. BTCPay’s hot wallet stores the seed phrase on an internet-connected server and can sign payments automatically, a feature its own documentation marks with a “DANGER” label because anyone who breaks into the server can send the coins away. Coming days after the record Binance theft, the alert adds to concerns about operational security across crypto, from the largest exchanges to merchants running their own infrastructure.
What’s Next?
Merchants are being told to keep servers offline until the investigation is complete. Watch for BTCPay to identify the attack vector, confirm which versions are affected, and release a fix, as well as for any loss figures. Businesses still on versions older than 2.4.2 face the most immediate risk, and the episode could push more merchants toward cold storage or custodial payment providers.
Affected Tickers and Coins: BTC
Source: CoinDesk
