BTCPay Server has issued an urgent shutdown advisory to merchants after attackers reportedly gained access to outdated installations and emptied connected hot wallets. The incident has raised security concerns for Bitcoin businesses, particularly those operating versions 2.4.1 or earlier, as questions remain about the total losses and the number of affected payment systems.

BTCPay Server is a free, open-source Bitcoin payment processor that enables merchants to manage transactions through their own infrastructure rather than depending on centralized payment providers. The platform advised all operators to take their instances offline after reports of suspicious hot wallet withdrawals surfaced. Subsequent investigation identified older software releases as the suspected entry point.

At 04:07 UTC on Monday, the development team confirmed that the attack vector involved servers running version 2.4.1, released on July 23, or earlier versions. The project said it had not received credible reports of similar wallet drains affecting installations running version 2.4.7. However, the investigation has yet to establish the total value of stolen funds or the number of compromised merchants.

Unlike the recent Binance hack, which involved a major centralized exchange, this incident targeted independently operated payment infrastructure. The attack highlights the security challenges faced by businesses that manage their own Bitcoin wallets and payment systems.

The situation has left merchants seeking clarity about their exposure and the steps necessary to secure their remaining funds.

How Attackers Gained Access to BTCPay Server Hot Wallets

Initial findings indicate that attackers obtained administrator privileges on older BTCPay Server installations before withdrawing cryptocurrency from their connected hot wallets.

The project issued its first emergency alert at 22:25 UTC on Sunday, instructing operators to execute the shutdown script and suspend their servers until the investigation was completed.

Roughly two hours afterward, founder Nicolas Dorier confirmed that the project’s own public servers running version 2.4.7 had not been compromised.

Dorier explained that unauthorized users had managed to log in as administrators on older installations, although the exact method used to obtain access was still being examined.

Hot wallets retain private signing keys on the server, allowing merchants to process refunds, payouts, and other transactions automatically. However, this arrangement creates an additional attack surface. If someone gains administrator-level control of the server, they may also be able to authorize transfers from its connected wallet.

Several hosting providers responded to the warning by disabling vulnerable installations. BTCPay Server recognized LunaNode and other providers for taking independent action to shut down older hosted instances. As a result, some merchants may have found their payment services temporarily unavailable on Monday.

The release timeline provides further insight into the security issue. BTCPay Server introduced version 2.4.1 on July 23. Approximately two weeks later, version 2.4.2 arrived with a critical security fix after developers reported that the vulnerability was already being actively exploited.

Five more software releases followed, leading to version 2.4.7, published on Thursday. The latest update also resolved 85 security findings identified during an AI-assisted assessment conducted by Anthropic for the project.

Investigators have not confirmed whether the latest attack shares a connection with the vulnerability disclosed in August. Dorier has said that a detailed investigation report will provide further technical information.

BTCPay Server Security Warning: Which Merchants Are Affected?

The project’s current assessment identifies installations running version 2.4.1 or earlier as potentially vulnerable.

Dorier has offered reassurance to merchants who installed at least one update following the release of version 2.4.2, indicating that they have no reason to panic based on the available findings.

Nevertheless, operators should take the following security measures:

Check the installed software: Merchants should verify their current BTCPay Server version. Any installation running 2.4.1 or an earlier release should remain offline until the update process is completed.

Install version 2.4.7: Administrators can update through Server Settings → Maintenance by selecting the Update option. Docker-based operators can run the btcpay-update.sh script over SSH, while Umbrel and Start9 users can install the latest release through their respective platforms.

Limit hot wallet exposure: Businesses should avoid maintaining substantial Bitcoin balances in internet-connected hot wallets. Regularly moving accumulated payments into cold storage while retaining only the amount required for refunds can reduce potential losses.

Report unauthorized withdrawals: Merchants who identify suspicious activity should send incident information and relevant server logs to security@btcpayserver.org.

The reported attacks have specifically involved hot wallets. By comparison, merchants using watch-only wallet configurations keep their private signing keys outside the BTCPay Server environment, reducing the risk associated with server-side key exposure.

Bitcoin Price Shows Limited Reaction to the BTCPay Server Attack

Bitcoin’s market price remained relatively stable following the emergency security announcement.

BTC was valued at approximately $77,890 when BTCPay Server issued its warning. By 07:40 UTC on Monday, the cryptocurrency was trading around $78,102 on Binance, reflecting a gain of approximately 0.3% over the previous 24 hours.

The market was still processing the consequences of the previous week’s Binance security breach, which contributed to increased selling pressure across digital assets.

Bitcoin’s technical indicators also remain central to the near-term outlook. On October 30, BTC declined to approximately $76,326, approaching its 200-day exponential moving average (EMA) near $76,512. Buyers have since managed to keep the price above this indicator for three consecutive days.

On the upside, the 50-day EMA around $80,293 represents an important resistance level. Another significant barrier sits at $81,971, which marked Bitcoin’s October 29 high before the Binance incident.

For the recovery to gain further momentum, Bitcoin needs to defend its 200-day EMA and overcome resistance in the $80,000–$82,000 range. The market’s ability to reclaim these levels could determine whether BTC resumes its upward movement or remains trapped in its current trading range.