BTCPay Server hit again as hackers drain merchant hot wallets

Updated 2 November, 00:52 UTC. Lead developer Nicolas Dorier says the attacks so far hit instances older than 2.4.2, where the attacker logged in as admin, and that servers on 2.4.7 were not attacked.

BTCPay Server, the open-source software merchants run on their own servers to accept bitcoin, is telling everyone who runs it to shut it down after reports that attackers are emptying hot wallets. "We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers," the project posted on X at 22:25 UTC. "If you're running an instance, please shut it down (./btcpay-down.sh) until we complete the investigation."

Rockstar Dev, a BTCPay Server contributor, narrowed the warning to those setups: "Not a drill: shut down your BTCPay Server if you have a hot wallet." At least one BTCPay Server user replied that their hot wallet was empty.

Two hours later, lead developer Nicolas Dorier said the project's own public servers, which run the current version 2.4.7, were not attacked, and that the reports so far appear to come from instances running versions older than 2.4.2. "The attacker managed to log in as admin on those instances," he wrote. "We are still trying to figure out how." The project has not said how many servers were hit or how much was taken, and has not published an advisory.

The August incident

This is the second time in three months that BTCPay Server users have lost funds. In August the project said a vulnerability let an unauthenticated attacker obtain credential files for LND, the Lightning node software many instances run alongside it, and that funds were stolen from those nodes. Its advisory at the time said that "BTCPay Server's on-chain wallets, including hot wallets, are not affected." The reports now concern those hot wallets.

Since August the project has shipped a run of security releases. The most recent, version 2.4.7 on 29 October, fixes 85 security findings, one rated critical and 13 high, reported through Anthropic's open-source scanning program. Versions older than 2.4.2 also lack the August fix.

BTCPay Server's instruction for now is to take instances offline until it completes its investigation. After the August incident the project asked affected users to send on-chain addresses and transaction details to security@btcpayserver.org to help trace and freeze stolen funds.