BTCPay Server warns operators to shut down servers as attackers drain Bitcoin hot wallets
- Severity
- High
- Sources
- 1
What happened
BTCPay Server has told operators to run ./btcpay-down.sh and keep instances offline while hot wallet sweeps are investigated, with no version restriction in the official notice. Reports attribute the compromise to installations older than 2.4.2 where attackers obtained administrator logins, but the initial access vector is unconfirmed and no CVE is linked. Founder Nicolas Dorier reportedly said the public 2.4.7 servers were not attacked, which does not clear updated installations; the 2.4.7 release (29 October) fixed 85 findings, and the earlier 2.4.2 LND credentials advisory explicitly excluded on-chain hot wallets.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Shut down any BTCPay Server instance using ./btcpay-down.sh and keep it offline until the project issues further guidance.
- Check whether the installation runs a version older than 2.4.2, as early reports link the attacks to such versions.
- Do not treat updating alone as resolving an active compromise while the investigation is ongoing.
- Follow official BTCPay Server channels to tell confirmed developer instructions apart from community reports.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Companies
Products