BTCPay Server, an open-source cryptocurrency payment processor, has launched an urgent security investigation following reports of unauthorized hot wallet withdrawals. In an initial alert issued on November 2, the development team advised operators to temporarily take their instances offline using shutdown scripts while investigators worked to isolate the breach mechanism. The team has since narrowed the primary vector to unpatched servers operating version 2.4.1 or earlier, confirming that no credible wallet drain reports have emerged regarding the latest release, version 2.4.7.
The incident marks the second major security scare for the project in recent months, following an August exploit involving compromised Lightning Network administrative credentials. In the current breach, attackers managed to acquire full administrator privileges on vulnerable instances, enabling them to initiate sweeps that transferred online operational funds directly to unauthorized external destinations. BTCPay Server co-founder Nicolas Dorier confirmed that public nodes running version 2.4.7 remained entirely unaffected, though developers have yet to publicly disclose the precise technical loophole leveraged to hijack admin accounts.
To mitigate further exposure across the ecosystem, multiple third-party hosting providers, including LunaNode, moved swiftly to shut down exposed customer servers automatically. While BTCPay Server has not released figures regarding total losses or compromised machines, the team urged operators relying on self-hosted infrastructure to update immediately to release 2.4.7 and submit system logs if unauthorized activity is suspected. The organization reiterated the importance of practicing strict security hygiene, strongly recommending that merchants limit hot wallet allocations and transfer larger balances into offline cold storage until the inquiry concludes.
