BTCPay Server Urges Shutdown After Bitcoin Wallet Drains
BTCPay Server has urged merchants to take internet-connected instances offline after reports that attackers drained bitcoin from linked hot wallets. Users are advised to shut down instances manually with ./btcpay-down.sh while the investigation continues.
Founder Nicolas Dorier said reported incidents appear to involve software versions older than 2.4.2. The project has not confirmed the attack method, the number of affected servers or the amount of bitcoin stolen. Reports of possible administrator-level access have also emerged, but remain unconfirmed. BTCPay Server has not announced a fix or confirmed newer versions are safe.
The warning followed the release of version 2.4.7, which fixed 85 reported security issues; public and demo servers running that version had not been reported attacked at the time of the earlier update. The incident highlights the risks of outdated payment software and storing wallet seed phrases on online servers. The impact on Bitcoin trading is uncertain, while merchants face potential losses and operational disruption.
Neutral
The incident directly concerns the security of BTCPay Server deployments and the bitcoin held in merchants’ hot wallets, rather than a flaw in Bitcoin’s protocol or network. It could prompt short-term caution among affected merchants and traders, particularly if further losses or broader exposure are confirmed. However, the number of affected servers and the amount stolen remain unknown, and there is no evidence here of a wider disruption to Bitcoin markets. Historically, security incidents tied to individual services can cause temporary concern, but their effect on BTC prices is often limited unless they trigger substantial selling or threaten broader market infrastructure. Longer term, the episode may reinforce demand for offline key storage and safer custody practices, but it does not by itself establish a lasting bearish signal for Bitcoin.