Is Your BTCPay Server Safe? Security Warning Issued

BTCPay Server Faces Hot Wallet Drains

Attackers recently gained admin access to outdated BTCPay Server instances and emptied their connected hot wallets.

The security team discovered that the underlying flaws trace back to issues that existed before an August patch.

Financial losses currently impact operators who failed to update their server software. The official team has not yet released total loss figures.

What Is BTCPay Server and How Does a Hot Wallet Work?

BTCPay Server is a popular free and open-source payment gateway. It allows merchants to accept BitcoinBTC+0.05% directly without relying on third-party payment processors.

Many store owners use a hot wallet setup on their server. In a hot wallet setup, private keys stay directly on the server host.

This setup allows the system to send funds and process payouts automatically without requiring the operator to manually sign every transaction.

Think of a hot wallet like cash stored inside a cash register. It makes everyday transactions fast and convenient.

However, that convenience brings extra risk. If an attacker gains administrator rights to your server host, they can easily transfer all your stored coins.

Which Software Versions Are Targeted?

The BTCPay Server team raised the alarm late on November 1. They initially asked all operators to shut down their instances while conducting a detailed investigation.

Shortly after, a follow-up announcement narrowed down the scope of the vulnerability.

• Targeted versions: Version 2.4.1 (released July 23) and any older software releases.
• Safe versions: Version 2.4.7 shows no credible reports of hot wallet compromise.

BTCPay Server founder Nicolas Dorier stated that attackers logged into affected servers using administrator rights. However, the exact entry path remains under investigation.

Preliminary findings show traces of security vulnerabilities that predated version 2.4.2.

A Repeating Trend in Unpatched Bitcoin Infrastructure

This event marks the second time in three months that hackers stole funds from BTCPay Server software older than version 2.4.2.

Back in August, developers released a patch to fix a critical flaw. That vulnerability allowed remote attackers to steal secret credentials for Lightning Network nodes.

Even back then, malicious actors were actively exploiting that security hole before many node owners applied the update.

A similar situation occurred recently with Core Lightning nodes. Core Lightning developers issued urgent warnings after hackers began targeting unpatched node installations.

In both situations, safe software updates existed before the thefts happened. The main point of failure was simply operators setting up an instance once and never updating it.

How Hosting Providers Responded

Third-party cloud hosting providers moved quickly to protect their users.

Companies like LunaNode automatically shut down customer instances running outdated software to block potential exploits.

Should You Use a BTCPay Server Hot Wallet?

Nicolas Dorier runs version 2.4.7 on his own server with a hot wallet enabled. Even so, he strongly cautions against holding large crypto balances online.

Don't put more than you are ready to lose in hot wallet. We can't guarantee it won't happen again.

If you host self-managed crypto infrastructure, keeping your server updated is essential to maintaining security.

• Update immediately: Ensure your BTCPay Server software runs version 2.4.7 or newer.
• Keep minimal funds: Keep only small operating balances in hot wallets.
• Use offline storage: Transfer daily earnings to hardware wallets or cold storage systems.