BTCPay Server, an open-source solution widely used by merchants for direct Bitcoin transactions, has issued an urgent directive for its operators to deactivate their systems. This measure comes in response to numerous reports indicating that hot wallets on several servers have been compromised and funds illicitly transferred. The project's team has initiated a thorough investigation into the security breach, emphasizing the need for immediate shutdown to prevent further losses while the root cause and full scope of the attack are being determined. This development underscores the persistent security vulnerabilities within the digital asset landscape and the critical importance of robust protection for online cryptocurrency storage.
The notification, disseminated via social media, specifically instructed all instance runners to utilize the provided shutdown command and keep their systems offline until the ongoing investigation concludes. As of now, BTCPay has not released specific details regarding the nature of the attack, the exact number of servers affected, or the total amount of cryptocurrency that has been illicitly accessed. This lack of detailed information has naturally led to heightened concern within the community, especially following previous security incidents.
Hot wallets, characterized by their continuous connection to the internet, facilitate automatic fund transfers, such as processing refunds. However, this convenience also renders them more susceptible to cyberattacks compared to offline storage solutions. It is crucial to note that the current incident pertains to the software built around Bitcoin, not the fundamental Bitcoin network itself, which remains secure. This distinction is vital for understanding the scope of the vulnerability and its impact on the broader cryptocurrency ecosystem.
This latest security alert follows closely on the heels of two other recent security events impacting the project. Just days prior, on October 29, BTCPay rolled out an emergency update, version 2.4.7, to patch a critical vulnerability along with several medium-risk flaws. Furthermore, in August, a separate security flaw was exploited, leading to the theft of Lightning Network credentials and the draining of nodes operating behind BTCPay instances, including one managed by Foundation, a hardware wallet manufacturer. At that time, BTCPay had assured users that standard on-chain wallets, including hot wallets created within their software, remained unaffected by the August incident. The current reports are particularly significant because they now indicate that hot wallets, previously deemed secure from the August flaw, are indeed being targeted.
The critical questions that remain unanswered are whether these new attacks are linked to the vulnerabilities that were addressed in the recent October 29 update and if servers that had already installed this patch are still susceptible. The project's ability to pinpoint a specific vulnerable software version will be key. Additionally, the eventual disclosure of total financial losses and verifiable reports from affected merchants will clarify the true scale of this security challenge. Historically, initial security warnings can sometimes present a broader scope than the final assessment, as BTCPay demonstrated in August when it significantly narrowed the reported impact. Until BTCPay issues an all-clear, all operators managing funds in a BTCPay hot wallet are strongly advised to adhere to the shutdown recommendations to safeguard their assets.