BTCPay Server has issued an emergency warning to merchants, advising them to shut down their payment servers after attackers reportedly accessed and emptied hot wallets connected to outdated software versions. The incident primarily involves installations running version 2.4.1 or earlier, prompting questions about the scale of the breach and the safety of merchant funds.
The open-source Bitcoin payment platform, which allows businesses to independently manage cryptocurrency transactions without relying on centralized payment processors, announced the shutdown recommendation after receiving reports of unauthorized hot wallet withdrawals. Within hours, the investigation pointed toward older software versions as the likely source of the security problem.
At 04:07 UTC on Monday, BTCPay Server confirmed that its investigation had identified an attack method targeting installations running version 2.4.1, released on July 23, or older builds. The team reported no credible evidence of similar fund losses involving the latest version, 2.4.7. However, the project has yet to reveal how much Bitcoin was stolen or how many merchant accounts were affected.
The incident differs from last week’s Binance hack because the attackers did not target a centralized exchange. Instead, they went after businesses operating their own Bitcoin payment infrastructure, raising fresh concerns about the security of self-hosted cryptocurrency services.
This leaves merchants wondering whether their installations are vulnerable and what immediate actions they should take to secure their funds.
How Did Attackers Drain BTCPay Server Hot Wallets?
According to the preliminary investigation, the attackers obtained administrator-level access to vulnerable BTCPay Server installations and subsequently transferred funds from their connected hot wallets.
The project initially raised the alarm at 22:25 UTC on Sunday, asking all operators to execute its emergency shutdown script and temporarily disable their instances while the investigation was underway.
Around two hours later, founder Nicolas Dorier clarified that the project’s own public-facing servers, which were operating on version 2.4.7, had not been affected.
Dorier said the attackers had managed to obtain administrator access to older installations, although the precise method used to gain entry remained under investigation.
Hot wallets are designed to keep private signing keys on the server, allowing businesses to process customer refunds and outgoing payments automatically. However, this convenience introduces additional risks. If an attacker obtains administrative control of the server, they may also gain the ability to authorize cryptocurrency transfers.
Several hosting companies quickly responded to the security alert. BTCPay Server specifically acknowledged LunaNode and other providers for independently shutting down older hosted installations. As a result, some merchants may have experienced temporary interruptions to their payment services on Monday.
The sequence of software releases provides additional context. BTCPay Server published version 2.4.1 on July 23. Approximately two weeks later, version 2.4.2 was released to address a critical security vulnerability that the developers said was already being actively exploited.
Five subsequent updates followed, with version 2.4.7 becoming the latest release on Thursday. This update also resolved 85 security issues uncovered through an AI-powered security review performed by Anthropic for the project.
Investigators have not yet established whether the latest attack is related to the vulnerability reported in August. Dorier has promised a more comprehensive explanation in an upcoming security report.
Which BTCPay Server Merchants Are Vulnerable?
The project’s current findings identify servers running version 2.4.1 or earlier as the affected installations.
Dorier offered some reassurance to operators who had installed at least one update following the release of version 2.4.2, explaining that these users did not need to panic based on the information available.
Merchants should nevertheless follow several important security precautions:
Check the software version: Operators should verify their installed BTCPay Server version immediately. Any installation running 2.4.1 or an earlier release should remain offline until the necessary update is completed.
Install the latest release: Merchants should upgrade to version 2.4.7. The update is available through Server Settings → Maintenance for administrators. Docker users can execute the btcpay-update.sh script through SSH, while Umbrel and Start9 operators can update through their respective application platforms.
Reduce hot wallet exposure: Merchants should avoid keeping substantial Bitcoin balances in wallets connected directly to their payment servers. Regularly transferring accumulated funds into cold storage while retaining only enough liquidity for refunds can reduce potential losses.
Notify the security team: Businesses that identify unauthorized transactions should submit incident information and relevant server logs to security@btcpayserver.org for investigation.
Importantly, the reported incidents have involved hot wallets. Businesses using watch-only wallet configurations have an additional layer of protection because their private signing keys are not stored on the BTCPay Server itself.
Did the BTCPay Server Hack Trigger a Bitcoin Price Reaction?
Despite the security concerns, Bitcoin showed little immediate reaction following the BTCPay Server warning.
BTC was trading at approximately $77,890 when the emergency announcement was published. By 07:40 UTC on Monday, its price had moved to around $78,102 on Binance, marking a gain of roughly 0.3% over 24 hours.
The broader cryptocurrency market was still dealing with the consequences of the previous week’s Binance hack, which had intensified selling pressure across digital assets.
Bitcoin’s technical structure also remains important. On October 30, the cryptocurrency dropped to approximately $76,326, approaching its 200-day exponential moving average (EMA), currently positioned near $76,512. Buyers have successfully defended this technical indicator for three consecutive days.
However, the recovery faces resistance from the 50-day EMA near $80,293. Beyond that level, $81,971 remains another significant barrier, marking Bitcoin’s October 29 high before the Binance security incident.
For now, traders are monitoring whether BTC can maintain its position above the 200-day EMA while attempting to recover toward the $80,000–$82,000 resistance region. The ability to defend this support could play an important role in determining Bitcoin’s next directional move.
