Open-source payment tool BTCPay Server has issued an urgent call for its users to temporarily shut down their systems following reports of unauthorized emptying of bitcoin hot wallets. Users are advised to keep their servers offline until the company concludes a thorough review of the situation.
Investigation Continues as Security Fears Mount
BTCPay Server is widely recognized for enabling businesses to accept bitcoin payments directly into their wallets without relying on third-party custodial services. However, the inherent security risks associated with hot wallets—given their internet connectivity—have come to the forefront. The project team revealed receiving notifications of attackers fully draining hot wallets from multiple servers, yet detailed findings including the number of affected servers and the total loss remain undisclosed. A definitive fix for the issue has also not been released.
BTCPay Server’s team announced receiving alerts about unauthorized actors draining funds from hot wallets on certain BTCPay servers, prompting them to instruct users to shut down systems until investigations conclude.
Due to BTCPay Server’s decentralized architecture, where each business operates the software on its private server, there is no central authority to initiate a systemic shutdown. Consequently, project developers issued their appeal directly to server administrators, as they lack the capability to halt operations on behalf of users.
Risks of Hot Wallet Exposure Highlighted
Hot wallets provide expedited payment processing times due to their internet connection, but this accessibility means that sensitive information necessary for signing transactions is stored on the server. Unauthorized server access can, therefore, lead to potential fund transfers. The BTCPay Server documentation explicitly warns about these security implications.
BTCPay Server founder Nicolas Dorier pointed out that initial findings suggest a link to older versions of the software, specifically those preceding version 2.4.2. Dorier noted that public servers used by the project team running on version 2.4.7 have not been compromised, although he refrained from confirming the absolute security of more recent software versions.
Nicolas Dorier commented that reports indicate a correlation with BTCPay Server versions older than 2.4.2, yet how attackers obtained administrator access remains undetermined.
Revival of Past Vulnerabilities Raises Alarm
According to Dorier, attackers reportedly logged in using administrator accounts on the compromised servers, granting them maximum privileges within the system. The team remains uncertain about the method of access employed by the perpetrators.
In August, BTCPay Server verified a security flaw in versions preceding 2.4.2 that allowed third parties to extract LND credential files pivotal to the Lightning Network’s functionality. These credentials enabled attackers to control the node and move funds; this vulnerability was remedied in the 2.4.2 update.
The recent breach occurs as security debates within the crypto market intensify. Nonetheless, BTCPay Server has yet to reach a definitive conclusion regarding the root cause, scope, and confirmation of a safe software version until their investigation ends.
