Overview
- BTCPay Server told operators to shut down their instances on Sunday after reports that attackers were logging in as administrators and emptying hot wallets on older installs.
- The project’s investigation narrowed the campaign to servers running version 2.4.1 (July 23) or earlier and said there are no credible reports of drains affecting the latest 2.4.7 release.
- Blockchain analysis traced at least 18.38 BTC and 3,405 LTC, worth about $1.63 million, moving to addresses BTCPay named, though investigators say that figure is a floor and the full loss total is unknown.
- BTCPay and hosting providers have advised affected operators to preserve logs, rebuild on a fresh server with a new wallet because updates may not remove attacker access, and to report incidents to security@btcpayserver.org.
- The case underscores that self-hosted payment software transfers responsibility for patching and key custody to merchants, and it could push more stores to limit hot-wallet balances, shift funds to cold storage, or use hosted services with managed updates.