BTCPay Server hot wallets have been compromised. The team issued an alert on X, advising all instance operators to shut down their servers immediately and bring them back online only after the investigation is complete.
The official statement said, “We have received reports that hot wallets on multiple instances are being drained by unauthorized attackers.” But the alert didn’t specify which versions are affected, confirm the amount of losses, or release a patch. The shutdown order applies to all versions without distinction. This “shut everything down first, investigate later” approach is itself a signal: until the attack vector is understood, it’s impossible to determine which configurations are safe.
BTCPay’s hot wallet is at the heart of this incident because of how it is designed. The hot wallet feature stores the seed on the server and uses it to sign transactions locally, without requiring an external hardware device. The benefit is automation and convenience; the trade-off is that if the server is compromised, the seed is exposed and the funds can be transferred directly. BTCPay is self-hosted software, so the decision of whether and when to shut down ultimately rests with each server operator; the official team can only make recommendations. This also means that the extent to which this security incident affects users depends largely on how quickly operators respond to the alert.
There’s a timeline worth looking at separately. On October 29, BTCPay Server released an emergency update, version 2.4.7, fixing one critical vulnerability and several medium-severity vulnerabilities. Then, reports of hot wallet theft began to emerge between November 1 and 2. The official team has not said whether the incident is related to the vulnerabilities fixed on October 29, or whether the shutdown scope specifically targeted instances that had not upgraded to 2.4.7. Another potentially confusing piece of background is an LND credential leak in August. At the time, attackers could obtain macaroon files and control Lightning nodes, but BTCPay’s official team explicitly stated that the vulnerability did not affect on-chain wallets, including hot wallets. So, based on the information publicly available, it is not valid to explain this hot wallet theft by citing the August incident.
For now, there’s only one thing we can confirm: the hot wallet feature inherently offers no isolation when a server is compromised. The seed is on the server, signing happens on the server, and the security of the funds depends entirely on the security boundary of the server itself. For operators running BTCPay instances, shutting them down is the only option they can proactively take to control risk under the current circumstances, until the official team provides details on which versions are affected and how to fix the issue. As for the path the attackers used, the scale of the losses, and whether the incident is connected to the software update released a few days ago, none of these questions has a public answer yet. We’ll have to wait for the official investigation findings.
#BTCPayServer呼吁运营者关闭实例 #BTC $BTC
Disclaimer: The content above is based on BTCPay Server’s official alert and publicly available reports. It is intended solely to summarize the facts and discuss security mechanisms, and does not constitute operational instructions or investment advice. Operators running instances should follow the latest official guidance.