BTCPay Server issued an emergency shutdown warning Nov. 1 after attackers drained bitcoin from hot wallets connected to self-hosted payment servers. The urgent notice instructed operators to immediately shut down their instances using the `./btcpay-down.sh` command.
Nicolas Dorier, founder of BTCPay Server, linked the compromises to software versions predating 2.4.2. Public servers running version 2.4.7—the current release—had not experienced attacks, indicating the latest update did not introduce the vulnerability.
Core contributor Uncle Rockstar Developer reinforced the threat directly: "Not a drill: shut down your BTCPay Server if you have a hot wallet."
The security alert came three days after BTCPay Server released version 2.4.7 on Oct. 29, which addressed 85 vulnerabilities identified through Anthropic's open-source security scanning. The findings included one critical flaw, 13 high-severity issues and 52 medium-severity flaws.
BTCPay Server is open-source software that allows merchants to accept bitcoin payments without relying on conventional payment intermediaries. Users self-host the software and manage their own wallet infrastructure—a design that places security responsibility directly on operators.
Developers have not yet disclosed the total amount of bitcoin stolen or the number of merchants affected. The initial alert provided no confirmed account of how attackers gained initial access to the compromised systems.
Dorier's preliminary investigation indicated attackers obtained administrator access to affected deployments. Forensic analysis pointed to vulnerabilities in older software releases.
In August, the project addressed a separate vulnerability that allowed unauthenticated attackers to acquire Lightning Network Daemon macaroon credentials—authorization tokens used for LND access. That flaw was corrected in version 2.4.2.
Investigators have not conclusively established whether the latest thefts involved the August vulnerability, a different older flaw, or multiple weaknesses. A complete technical account of the compromise is pending from the development team.
