BTCPay Server has instructed merchants to temporarily disable their payment systems after reports emerged that attackers had compromised hot wallets associated with outdated server installations. The security incident affects versions 2.4.1 and earlier, raising concerns about potential financial losses and the safety of Bitcoin payment infrastructure.
The free, open-source payment processor, widely used by businesses that prefer managing their own Bitcoin transactions, issued the warning after detecting suspicious activity involving merchant hot wallets. The development team initially advised all operators to shut down their instances while investigating the incident. Within several hours, outdated software emerged as the primary focus of the investigation.
At 04:07 UTC on Monday, BTCPay Server disclosed that the suspected attack method targeted installations running version 2.4.1, which was released on July 23, or older releases. The team said it had received no credible reports of funds being drained from installations running version 2.4.7. Nevertheless, the exact amount stolen and the total number of affected merchants remain undisclosed.
Unlike the recent Binance security breach, this incident did not involve a centralized exchange. Instead, attackers targeted merchants operating independently managed Bitcoin payment servers, highlighting the risks businesses face when maintaining their own cryptocurrency infrastructure.
The incident has raised concerns among merchants about whether their payment systems remain exposed and how they can prevent further losses.
BTCPay Server Attack: How Were Merchant Hot Wallets Compromised?
Preliminary findings suggest that attackers gained administrator access to vulnerable BTCPay Server installations before transferring cryptocurrency from their connected hot wallets.
The project published its initial security warning at 22:25 UTC on Sunday, instructing operators to execute an emergency shutdown script and keep their servers offline until investigators completed their assessment.
Approximately two hours later, founder Nicolas Dorier confirmed that the project’s publicly operated servers, which were using version 2.4.7, had not experienced the attack.
According to Dorier, the attackers successfully accessed older installations with administrator privileges. However, the development team had not yet determined exactly how those privileges were obtained.
Hot wallets store private signing keys directly on payment servers, enabling merchants to handle outgoing transactions, refunds, and payouts without manual intervention. However, this setup also introduces a potential security weakness. Unauthorized administrator access could allow attackers to control the wallet and transfer its available cryptocurrency.
Hosting providers also took precautionary action following the warning. BTCPay Server thanked LunaNode and several other providers for proactively disabling vulnerable hosted installations. Consequently, some businesses may have experienced temporary payment service disruptions on Monday.
The software update history provides an important clue. Version 2.4.1 was released on July 23, followed approximately two weeks later by version 2.4.2, which addressed a critical vulnerability that developers said was already being exploited.
Five additional updates were subsequently introduced, bringing the software to version 2.4.7 on Thursday. The latest release also addressed 85 security findings uncovered through an AI-assisted audit conducted by Anthropic.
Whether the current incident is connected to the vulnerability identified in August remains uncertain. Dorier has indicated that a detailed technical explanation will be published in a forthcoming report.
Who Is Exposed to the BTCPay Server Security Breach?
According to the project’s investigation, the currently identified vulnerability affects installations running version 2.4.1 or older.
Dorier provided some reassurance to merchants who had installed at least one update after version 2.4.2 became available, saying there was no reason for those operators to panic based on the findings so far.
However, merchants should take the following precautions:
Verify the installed version: Businesses should immediately check which BTCPay Server release they are using. Installations running version 2.4.1 or earlier should remain offline until they have been updated.
Upgrade to version 2.4.7: Administrators can install the latest release through Server Settings → Maintenance by selecting the Update option. Docker operators can execute the btcpay-update.sh script through SSH. Umbrel and Start9 users can complete the process through their respective platforms.
Keep limited funds in hot wallets: Merchants should avoid storing large Bitcoin balances in wallets connected to internet-facing servers. Moving accumulated revenue into cold storage and maintaining only the funds required for refunds can limit potential exposure.
Contact the security team: Anyone who discovers unauthorized withdrawals should submit incident details and relevant server logs to security@btcpayserver.org.
The reported losses have so far involved hot wallets. Merchants using watch-only wallet arrangements have a different security setup because their private signing keys remain outside the payment server.
Bitcoin Price Remains Stable Following the BTCPay Server Warning
The BTCPay Server incident has not produced an immediate negative reaction in Bitcoin’s market price.
When the emergency warning was published, BTC was trading near $77,890. By 07:40 UTC on Monday, the cryptocurrency had climbed to approximately $78,102 on Binance, recording a daily increase of around 0.3%.
Investors were already assessing the wider market impact of the previous week’s Binance hack, which had triggered substantial selling pressure across the cryptocurrency sector.
From a technical perspective, Bitcoin’s recent price action has placed the 200-day exponential moving average (EMA) in focus. On October 30, BTC dropped to approximately $76,326, approaching the indicator near $76,512. Buyers have managed to defend this level for three consecutive sessions.
Meanwhile, the 50-day EMA around $80,293 represents the next significant resistance. Bitcoin also faces an additional hurdle near $81,971, corresponding to its October 29 high before the Binance security incident.
For the broader recovery to gain strength, BTC will need to maintain support above its 200-day EMA and eventually reclaim the $80,000–$82,000 region. Whether buyers can overcome these resistance levels will help determine the cryptocurrency’s next major move.
