BTCPay Wallets Drained on Old Versions — Is Your Server Next?

What if the box that takes your Bitcoin payments could empty itself while you sleep? That is the fear behind BTCPay Server's weekend warning, after attackers swept coins out of merchants' hot wallets — and every shop still running old software is now on notice.

Key points:

• Attackers drained hot wallets on servers running version 2.4.1 or older, and BTCPay first told every operator to switch their machine off.
• No drained wallets have been reported on the newest release, 2.4.7, so the fix, for now, is simple: update.
• How the attackers got admin access is still unknown, and BTCPay has not said how many shops were hit or how much was taken.

On Sunday night, BTCPay said it was getting reports of hot wallets on its servers being swept by people who had no right to touch them. Its message was short and stark: shut your server down with the ./btcpay-down.sh command and leave it off until the team finishes its checks. BTCPay did not name a loss figure or a count of hit servers, and at that point it did not limit the warning to one version.

About two hours later, founder Nicolas Dorier gave the first detail: the reports appear to involve releases older than version 2.4.2. BTCPay has since pinned the problem to version 2.4.1 and older, and says it has seen no credible reports of drains on the latest release, 2.4.7. Operators are urged to update their installations. Dorier also said an attacker logged in as an admin on the hit servers, but the team does not yet know how that access was gained.

Read also: THORChain Halts Swaps on 10 Chains After Ethereum Reorg Bug

Why can't BTCPay just flip one switch?

BTCPay Server is a free, open-source tool that lets shops take Bitcoin payments straight into their own wallets, with no middleman holding the money. The catch is the hot wallet itself: it stays connected to the internet, and the seed phrase — the secret needed to send coins — sits on the merchant's own server. That means the server can sign and send a payment on its own, without the shop owner approving it on a separate device. BTCPay's own docs mark that setup with a "DANGER" label, and for good reason: anyone who breaks into that server can send the coins to their own address.

There is no master switch, either. Each shop runs its own server, so BTCPay cannot switch them all off from one place. It can only ask each owner to do it, one by one. That is why the warning went out as a plea to shut down, not as a fix pushed out to everyone at once.

In August, BTCPay had a similar scare. A flaw in versions before 2.4.2 let an outsider grab credential files for LND, the software that runs a node on Lightning, the faster payments network built on Bitcoin. With those files, an attacker could control the node and move its funds. BTCPay fixed that flaw in version 2.4.2, and it is still unclear whether the latest attack is linked to that old flaw. BTCPay has asked affected users to send information and logs to its security team, and it has not shared technical details of how attackers got into the wallets this time.

My own read is blunt: a payment tool that can send coins on its own is only as safe as its last update, and skipping an update is no longer a small delay — it is an open door.

Until the full picture comes out, the safe move is plain: keep the server off or update first, and check the version before you take another payment. A shop that reopens on old software is inviting the same thief back in.

Read also: FBI Blames North Korea for $6.3B Binance Hack — Can DeFi Block the Wallets?

— BitByLine News Desk

This is news only, not financial advice. BitByLine never tells you to buy or sell anything, and any move you make with your own money is your call and your risk, so check it yourself first. Read our full Disclaimer.

Sources: Cointelegraph, CoinDesk