BTCPay Server, which merchants run on their own machines to take Bitcoin payments, has told everyone running it to shut their servers down. On 1 November the project announced that unauthorized attackers were reportedly emptying hot wallets on BTCPay installations, and asked operators to stay offline until the investigation is finished.
The instruction is a single command, ./btcpay-down.sh, which stops the server. Nobody has published how much was stolen, how many merchants were hit or how the attackers got in. An early lead from the founder points at old installations, not current ones.
BTCPay’s notice on X went out at about 22:25 UTC on 1 November. Three minutes later core contributor Uncle Rockstar Developer added: “Not a drill: shut down your BTCPay Server if you have a hot wallet.” The warning does not name software versions and does not say when it is safe to switch back on.
Founder says the reports involve versions before 2.4.2
About two hours later, founder Nicolas Dorier posted an update. The project’s own public servers, which run 2.4.7, were not attacked, he wrote, and the reports seem to concern versions before 2.4.2. In those cases the attacker got in with an administrator login, and the team had yet to find out how.
That is a preliminary finding, not a diagnosis. A hot wallet keeps its signing key on the server itself, so anyone who gets admin access to the BTCPay instance can send the funds elsewhere. The thefts are described as coming from servers that had not been updated, but whether the way in was stolen logins, a software flaw or something else has not been stated.
Two earlier events that should not be mixed up
Version 2.4.7 came out on 29 October with fixes for 85 security findings, among them one critical and 13 high-severity issues, reported through Anthropic’s open-source scanning programme. Nothing published so far connects those fixes to the thefts.
The project also had a separate incident in August, when a flaw exposed credentials for Lightning (LND) nodes and led to an emergency 2.4.2 release. BTCPay said at that time that its on-chain hot wallets were not affected by that bug. Whether the new thefts are related is not established.
What operators can do now
Until BTCPay says more, the only official guidance is to run the shutdown command and wait. Operators on very old versions should treat any funds in a server-held hot wallet as at risk and check their wallet history, since a lack of alerts does not prove nothing moved. Dorier’s own advice, reported alongside the warning, is to keep only as much in a hot wallet as you could afford to lose.
BTCPay has said a fuller explanation is coming once the investigation concludes. Its X account is where any all-clear or new release would be announced first.
