Overview
- The project told operators to shut down instances after receiving reports of hot wallets being swept and posted the initial warning on Sunday, Nov. 1.
- Incident responders say the attacks targeted servers running version 2.4.1 or earlier and that there are no credible reports of drains on the latest 2.4.7 release.
- BTCPay co-founder Nicolas Dorier confirmed attackers logged in with administrator privileges on compromised instances while investigators work to determine how that access was obtained.
- Hosting providers including LunaNode have proactively shut older installations, BTCPay published Bitcoin and Litecoin addresses linked to the incidents, and it has asked victims to preserve and send logs to its security team.
- The case underscores a core risk of self-hosted hot wallets because signing keys stay online, and operators are being urged to move excess funds to cold storage, rebuild suspected machines on fresh servers, and limit hot-wallet balances.