BTCPay Server issues emergency shutdown warning amid hot wallet attacks

BTCPay Server called on operators to shut down their instances on Sunday after learning that unauthorized parties were accessing and draining hot wallets. In an announcement on X, the project requested that all instance administrators take their platforms offline using the shutdown command pending the investigation’s conclusion.

The project, however, has yet to reveal the root cause, the number of affected servers, or the total amount stolen.

BTCPay Server has suffered two other incidents recently

BTCPay Server shared on X: “We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers. If you’re running an instance, please shut it down (./btcpay-down.sh) until we complete the investigation.”

Given that BTCPay is self-hosted, the task of turning it off falls squarely on the owners of the individual servers. According to its documentation, the hot-wallet functionality stores the seed directly on the server for signing transactions and enables fast payouts without relying on external hardware. Unfortunately, this convenience has made hot wallets much more vulnerable than cold storage.

Hot wallets are particularly vulnerable because their private keys are stored on internet-connected systems, so they can be accessed by attackers who compromise underlying infrastructure. Unlike cold wallets, which store signing keys offline, hot wallets prioritize convenience and enable merchants to process transactions more quickly.

For businesses using BTCPay Server to accept Bitcoin payments, a compromised hot wallet could expose funds intended for merchant settlements or customer transactions. The latest warning therefore raises questions about how operators can balance payment convenience with the need to protect private keys against unauthorized access.

Speaking on the incident, Samson Mow, CEO of JAN3, a BTC technology company, advised: “I think it should be a priority to get SamRock working with Indra ASAP so users of BTCPay can receive directly to Aqua Bitcoin and swap to cold regularly.”

This alert comes right after two other security incidents for the project. Just days ago, on October 29, BTCPay released an emergency update (v.2.4.7) to address this vulnerability and others.

In August, attackers also exploited another security loophole, leading to the theft of Lightning Network keys and draining multiple associated nodes, including one belonging to Foundation, the manufacturer of hardware wallets. However, BTCPay had assured its users that they were safe from this attack regarding their standard on-chain wallets and built-in hot wallets.

Nevertheless, it had asked users to update their servers to version 2.4 or, at least temporarily, disable their BTCPay Server instances until they could do so, thereby reducing the risk of unauthorized access.

Until the investigation is complete, operators may need to check their server activity, wallet balances and transaction histories for any suspicious movements. Those who suspect their hot wallets have been compromised should not continue to use potentially exposed signing keys.

Coldcard was attacked in August

In August, Coldcard, a popular manufacturer of Bitcoin-only wallets, was also hit by an exploit that has resulted in at least $116 million in confirmed losses so far. According to Blockaid CEO Ido Ben-Natan, the Coldcard incident exposed a fundamental weakness in crypto: reliance on private keys that can become a single point of failure.

Natan said, “It’s a single-use kind of access to these things. Now there’s beauty in that no one else can go in and have access to these things. The hardship in that is that it is a single point of failure.”

He further contended, “The learning here is that having your assets sit somewhere and forgetting about them and not thinking about them is not actually the solution because the pace of security is evolving. You have to either kind of constantly be paranoid or either outsource that decision-making process to someone else.”