Overview
- BTCPay Server told operators to shut down their instances after reports surfaced that attackers were sweeping funds from hot wallets, with the initial alert posted on Sunday.
- The project's incident response has traced the suspected attack vector to installations running version 2.4.1 (July 23) or older and says it has no credible reports of drains on the current 2.4.7 release.
- Founder Nicolas Dorier said attackers managed to log in with administrator privileges on affected servers, but investigators have not yet determined how that access was obtained.
- Hosting providers including LunaNode have proactively taken older hosted instances offline and BTCPay is asking operators who suspect a compromise to preserve and send server logs to its security team.
- This follows an August flaw that let attackers steal Lightning (LND) credentials from unpatched installs, underlining the risks of running hot wallets on self‑hosted servers and the need to update and move excess funds to cold storage.