BTCPay Server got rekt over the weekend — ~$1.6M drained from hot wallets.
Here's what happened:
• Only hot wallets on versions from July or earlier got hit (keys sitting directly on servers)
• Hardware wallets and cold storage? Untouched
• Attack vectors were still sweeping funds when Bitquery stopped tracking
• The vulnerability? Servers that hadn't been patched in 3+ months
$BTC did exactly what it was told to do. The network isn't the issue — it's key management.
For anyone holding institutional exposure: ask yourself where your keys live and what has access to them. Hot wallets are convenient until they're not.
Cold storage isn't sexy, but it's the only real insurance policy in this game.
Here's what happened:
• Only hot wallets on versions from July or earlier got hit (keys sitting directly on servers)
• Hardware wallets and cold storage? Untouched
• Attack vectors were still sweeping funds when Bitquery stopped tracking
• The vulnerability? Servers that hadn't been patched in 3+ months
$BTC did exactly what it was told to do. The network isn't the issue — it's key management.
For anyone holding institutional exposure: ask yourself where your keys live and what has access to them. Hot wallets are convenient until they're not.
Cold storage isn't sexy, but it's the only real insurance policy in this game.