Some people are already shouting, “Another exploit—BTC is going to $50K,” over this BTCPay incident. Bro, first figure out what actually got drained.
The official statement says just one thing: hot wallets on multiple self-hosted BTCPay instances were drained without authorization. All operators should immediately run ./btcpay-down.sh to shut down and wait for the investigation results. No loss amount, root cause, affected versions, or patch were provided.
The key words here are “hot wallets.” A BTCPay hot wallet means keeping the seed on a server that’s online 24/7 so it can sign transactions itself. Whoever gets admin access to that machine can move the funds. Merchants using watch-only wallets with just an xpub don’t have any spendable private keys on the server, and BTCPay Lite, which uses an external wallet, was also said to be unaffected.
So this isn’t Bitcoin having a problem; it’s a bunch of small merchants keeping their cash register money in a vault. “Self-custody” doesn’t mean “secure.” Keeping your private keys on a public-facing machine is no different from leaving your wallet at an internet café.
Anyone using an incident with a payment tool to claim BTC will be cut in half either doesn’t understand what’s going on or is trying to trick you into selling at a loss. If you’re actually accepting payments with BTCPay: shut it down first, sweep the funds into a cold wallet, use watch-only for incoming payments from now on, and keep only enough in the hot wallet for change.
#BTCPay #Security
The official statement says just one thing: hot wallets on multiple self-hosted BTCPay instances were drained without authorization. All operators should immediately run ./btcpay-down.sh to shut down and wait for the investigation results. No loss amount, root cause, affected versions, or patch were provided.
The key words here are “hot wallets.” A BTCPay hot wallet means keeping the seed on a server that’s online 24/7 so it can sign transactions itself. Whoever gets admin access to that machine can move the funds. Merchants using watch-only wallets with just an xpub don’t have any spendable private keys on the server, and BTCPay Lite, which uses an external wallet, was also said to be unaffected.
So this isn’t Bitcoin having a problem; it’s a bunch of small merchants keeping their cash register money in a vault. “Self-custody” doesn’t mean “secure.” Keeping your private keys on a public-facing machine is no different from leaving your wallet at an internet café.
Anyone using an incident with a payment tool to claim BTC will be cut in half either doesn’t understand what’s going on or is trying to trick you into selling at a loss. If you’re actually accepting payments with BTCPay: shut it down first, sweep the funds into a cold wallet, use watch-only for incoming payments from now on, and keep only enough in the hot wallet for change.
#BTCPay #Security