BTCPay Server has urged merchants to take their payment systems offline after attackers reportedly drained hot wallets belonging to servers running version 2.4.1 or earlier. The security warning has raised concerns about which merchants may have been affected and whether their Bitcoin payment operations remain secure.
In the latest Bitcoin security development, BTCPay Server, a free and open-source payment processing platform commonly operated independently by Bitcoin merchants, instructed all server operators to shut down their instances following reports of unauthorized withdrawals from merchant hot wallets. Within six hours of the initial warning, investigators identified outdated software as the suspected entry point.
At 04:07 UTC on Monday, the development team announced that its investigation had identified an attack vector targeting servers running version 2.4.1, released on July 23, or earlier versions. According to the project, there were no credible reports of funds being drained from servers running the latest 2.4.7 release. However, BTCPay Server has not disclosed the total financial losses or the number of merchants affected.
Unlike last week’s Binance security incident, this attack did not involve a centralized cryptocurrency exchange. Instead, the targets were merchants operating their own payment infrastructure, highlighting the security challenges associated with managing self-custodied cryptocurrency systems.
The incident raises two important questions: which BTCPay Server operators were vulnerable, and what steps should merchants take to protect their funds?
What Happened in the BTCPay Server Hot Wallet Attack?
The attackers reportedly gained administrator-level access to older BTCPay Server installations before transferring funds out of their associated hot wallets. The project first issued its emergency warning at 22:25 UTC on Sunday, instructing operators to execute its shutdown script and keep their servers offline while the investigation continued.
Approximately two hours later, founder Nicolas Dorier confirmed that the project’s own publicly operated servers, which were running version 2.4.7, had not been compromised.
Dorier explained that the attackers had successfully accessed older instances with administrator privileges, although the team was still investigating how the unauthorized access occurred.
A hot wallet stores its private signing keys directly on a server, allowing merchants to process refunds and other payments automatically. However, this arrangement also creates a security risk because anyone who gains administrative control of the server may potentially access the wallet and transfer its funds.
Hosting providers responded quickly to the warning. BTCPay Server acknowledged LunaNode and other hosting companies for proactively taking vulnerable instances offline. Consequently, some merchants may have discovered that their payment stores were unavailable on Monday.
The software release timeline has become an important part of the investigation. Version 2.4.1 was published on July 23. Two weeks later, the development team released version 2.4.2 to address a critical vulnerability that it described as actively exploited. Five additional updates followed, culminating in version 2.4.7 on Thursday.
The latest release also addressed 85 security findings identified through an AI-assisted security assessment conducted by Anthropic for the project.
It remains unclear whether the latest incident is connected to the vulnerability disclosed in August. Dorier has indicated that the team plans to publish a detailed report explaining the attack.
Is Your BTCPay Server Store at Risk?
Based on the information currently available, the identified exposure involves installations running version 2.4.1 or older.
Dorier reassured merchants who had updated their software at least once after version 2.4.2 was released, stating that there was no reason for them to panic.
BTCPay Server operators should take several precautionary measures:
1. Verify the installed version: Merchants using version 2.4.1 or earlier should keep their servers offline until they complete the required security update.
2. Upgrade to version 2.4.7: Administrators can initiate the update through the Update option under Server Settings → Maintenance. Docker-based installations can use the btcpay-update.sh script through SSH, while Umbrel and Start9 users can install the update through their respective platforms by following the official BTCPay instructions.
3. Minimize hot wallet balances: Dorier has advised merchants against maintaining large amounts of Bitcoin in hot wallets. Businesses should regularly transfer accumulated sales revenue into cold storage while keeping only the necessary funds available for customer refunds.
4. Report suspicious transactions: Merchants who experienced unauthorized withdrawals should share relevant incident details and server logs with the security team at security@btcpayserver.org.
The reported incidents have involved hot wallets. Merchants using watch-only wallet configurations are in a different position because their private signing keys remain outside the BTCPay Server infrastructure.
Did the BTCPay Server Security Incident Affect Bitcoin’s Price?
The security warning did not appear to trigger an immediate reaction in the Bitcoin market.
BTC was trading near $77,890 when the emergency announcement was issued. By 07:40 UTC on Monday, Bitcoin was quoted around $78,102 on Binance, representing a daily gain of approximately 0.3%. Market participants were still assessing the fallout from the previous week’s Binance security breach.
That earlier incident established an important technical support area for Bitcoin. On October 30, BTC declined to $76,326, approaching its 200-day exponential moving average (EMA), which currently stands near $76,512. Buyers have managed to keep the cryptocurrency above this indicator for three consecutive days.
On the upside, Bitcoin faces resistance around its 50-day EMA at $80,293. The October 29 high of $81,971, recorded before the Binance incident, represents another important ceiling for the current trading range.
For now, Bitcoin’s ability to maintain support above its 200-day EMA remains an important factor in determining whether the market can recover from the recent security-related selling pressure.
About The Author
More Stories
Bitcoin Slips to $77,900 as Binance Sees $3.6B in Net Withdrawals
Binance Hack Fallout, U.S. Midterms and Jobs Data Set the Stage for Crypto’s Week Ahead
Bitcoin Edges Higher as Binance Faces $6B in Outflows After Reopening Withdrawals