BTCPay Server Warns of Attacks on Older Versions
BTCPay Server says attackers accessed older installations running version 2.4.1 or earlier, and users have reported unauthorized withdrawals from connected Bitcoin hot wallets. The project says attackers gained administrator access, but has not established how they did so. It has not disclosed the number of affected servers or the amount stolen, and its investigation is ongoing. BTCPay Server advises operators of affected installations to take servers offline and upgrade to version 2.4.7; the project reports no credible related wallet-drain cases on that version. Some hosting providers have also shut down instances as a precaution. The team is requesting incident details and server logs, and has not confirmed whether the attack is connected to an earlier issue involving Lightning Network Daemon credentials. The incident raises security concerns for self-hosted Bitcoin payment services, but its direct effect on BTC trading and broader market stability is likely limited.
Neutral
The incident affects the security of BTCPay Server installations and connected Bitcoin hot wallets, but the available information does not indicate a broad Bitcoin network or protocol issue. No confirmed loss totals or scale of compromise have been disclosed, and the project says it has no credible reports of related wallet drains on version 2.4.7. These factors limit the basis for a sustained BTC price reaction. In the short term, headlines about stolen hot-wallet funds could prompt caution or brief selling by traders sensitive to crypto-security news, while affected merchants may pause payment services as they update or investigate their servers. Over the longer term, the incident could encourage stronger security practices for self-hosted payment infrastructure, but without evidence of wider compromise or disruption to Bitcoin itself, it is unlikely on its own to materially affect BTC’s market stability or trend.