TL;DR

  • BTCPay Server asked all operators on Sunday, November 1, to shut down their instances after reports that hot wallets were being drained by unauthorized attackers.
  • Neither the number of affected servers, the cause, nor the amount lost has been disclosed yet.
  • The incident follows an emergency patch (version 2.4.7) released on October 29, as well as a separate security breach in August that affected Lightning nodes.
  • The market is already in risk-off mode: bitcoin is trading around $78,250 and the Fear & Greed Index stands at 37 out of 100.

Emergency alert sent out on X

BTCPay Server, the open-source system that allows merchants to accept bitcoin payments without a third-party payment provider, issued an urgent appeal on Sunday afternoon. The project asked everyone running their own instance to shut it down immediately using the command "./btcpay-down.sh", until an ongoing investigation is completed, ForexLive (investinglive.com) reports.

The background is reports that hot wallets on multiple servers have been drained by unauthorized attackers. A hot wallet is a wallet where the private keys reside on an internet-connected server, allowing the system to automatically send out funds, for example refunds to customers. This practical solution makes the wallet a far more attractive target than cold storage, which is physically disconnected from the internet.

It is important to clarify that the incident concerns the software surrounding bitcoin payments, not the bitcoin network itself. BTCPay has not yet disclosed how many servers have been affected, which vulnerability was exploited, or how much has been stolen.

We are receiving reports that hot wallets on BTCPay servers are being drained by unauthorized attackers. If you are running an instance, please shut it down until we have completed our investigation

Third incident in a short period

This is not the first time this year BTCPay Server has had to deal with a security issue. On October 29, the project released the emergency version 2.4.7 to patch one critical and several medium-severity vulnerabilities. BTCPay has not confirmed whether the new attack is connected to the vulnerabilities that were recently patched, or whether servers that have already updated to 2.4.7 are nevertheless affected.

In August, a completely different weakness was exploited, in which attackers stole so-called macaroon credentials for Lightning Network nodes and drained several operators, including hardware wallet manufacturer Foundation. At that time, BTCPay emphasized that the regular on-chain hot wallets built into the system were not affected. That makes Sunday's alert particularly notable, since it now appears to be affecting exactly the type of wallet that was spared in August.

A worrying pattern for self-hosted systems

BTCPay Server was originally created as a non-custodial alternative to centralized payment solutions like BitPay, precisely to give merchants full control over their own funds without intermediaries or fees. That strength is simultaneously a vulnerability: because each operator runs and secures their own installation, the pace of updates and security practices vary greatly from place to place.

In connection with the August incident, the project itself warned that artificial intelligence is shifting the balance of power between attackers and defenders, since it is now faster and cheaper to search through large codebases for weaknesses. Bitcoin-related projects are particularly exposed since they handle valuable assets directly.

What happens now

The key questions going forward are whether BTCPay can trace the attack to a specific software version, and whether servers that are already running the October 29 update are nevertheless affected. The scale of the losses and any statements from named merchants will show how serious the incident actually is. Experience from August shows that the initial warning does not necessarily reflect the final picture — back then, the scope was significantly narrowed as the investigation progressed.

Until BTCPay gives the all-clear, all operators with funds in a hot wallet are advised to follow the recommendation to shut down their instances.

Market context

The warning comes during a period marked by weak risk appetite in the crypto market. Bitcoin is currently trading around $78,250, and the Fear & Greed Index stands at 37 out of 100, indicating fear among investors. Security incidents of this kind, even when they affect infrastructure around bitcoin rather than the network itself, typically help reinforce an already nervous sentiment among both merchants and individuals using self-hosted solutions.