BTCPay Server Tells Operators to Shut Down Now as Bitcoin Hot Wallets Are Drained
An urgent warning, not a routine update
BTCPay Server, the open-source payment processor that lets merchants accept Bitcoin directly using self-hosted software, issued an urgent warning on November 1: attackers were draining Bitcoin hot wallets on its servers. In its security notice the project said it was receiving reports of hot wallets on BTCPay Servers being swept by unauthorised attackers, and it instructed operators to shut down their installations immediately — running ./btcpay-down.sh — and keep them offline while its team investigates. The warning did not limit that instruction to specific software versions, and it did not announce that restarting was safe. That bluntness is the point: when a payment server's hot wallet is being swept, the safe move is to stop the server first and ask questions second. No confirmed loss total and no count of affected installations had been reported at the time of writing, and this article does not invent either number.
What is known — and what is not
Early findings point toward outdated installations. Founder Nicolas Dorier reportedly said affected servers were running versions older than 2.4.2 and that attackers had logged in as administrators — but investigators had not established how they gained that access, leaving the initial entry point unconfirmed. The available reports did not establish whether attackers used stolen login details, a software flaw, or another route to administrator access. Dorier also said the project's public servers running version 2.4.7 had not been attacked. Separately, BTCPay Server 2.4.7 was released on October 29, with release notes listing 85 security findings addressed after reports from Anthropic's OSS Scanner program — but there is no confirmed link between those fixes and the current wallet drains, and this article does not claim one. An earlier advisory for version 2.4.2 concerned exposed Lightning Network Daemon credentials, and BTCPay explicitly said its own on-chain wallets, including hot wallets, were not affected by that earlier issue. Keeping those threads separate matters: conflating an old advisory with a live incident is how bad security advice spreads.
The same weekend, a second incident
The BTCPay warning was not the weekend's only security incident. On November 1, security firm Blockaid flagged an exploit on Arbitrum affecting Premia, a decentralised options protocol, reporting about $400,500 drained from its vaults in roughly two transactions while the attack was still running. Blockaid described the attacker abusing how vaults and option pools interact: creating empty option pools, taking a flash loan, buying options to lock vault collateral inside those pools, then withdrawing the locked funds. Later on November 1, PeckShieldAlert reported funds moved from Arbitrum to Ethereum, then swapped to BTC through Chainflip and NEAR Intents, putting its estimate at $464,600. Both figures are third-party estimates, and no verifiable statement from the project had been found at the time of writing — so treat the range, not either single number, as the honest picture, and do not treat either firm's post as a confirmed project disclosure. Together, the two incidents underline the weekend's theme: hot wallets and vault collateral are only as safe as the software and permissions around them, and outdated versions plus broad administrator access are exactly the combination attackers look for.
What operators and users should do
If you run a BTCPay Server instance, follow the project's own instruction: shut it down and keep it offline until BTCPay gives further guidance — do not restart on a guess, and do not trust unsolicited "fix" links. If you operate any self-hosted payment or node software, the checklist is the same one this weekend keeps teaching: update to the latest release, restrict administrator access, use strong unique credentials, and keep hot-wallet balances as small as the business allows, with the bulk of funds in cold storage. If you pay a merchant through BTCPay, you do not need to act on the server warning yourself, but be wary of any message claiming to be that merchant asking you to resend a payment to a new address. And for everyone else, the BTCPay incident is a reminder that "self-hosted" is not automatically "safe" — it means you are your own security team, and the update you postpone is the one attackers count on.
FAQ
What did BTCPay Server warn about? Reports that Bitcoin hot wallets on BTCPay Servers were being swept by unauthorised attackers, with operators told to shut down immediately.
How do I shut it down? Run ./btcpay-down.sh and keep the installation offline until BTCPay's team completes its investigation and issues guidance.
Which versions were affected? Early findings point to servers running versions older than 2.4.2; public servers on 2.4.7 were reportedly not attacked, but the entry point remains unconfirmed.
How much was lost? No confirmed loss total or affected-installation count had been reported at the time of writing.
What happened at Premia? Blockaid flagged about $400,500 drained from Premia vaults on Arbitrum via a flash-loan trick; PeckShieldAlert later estimated $464,600 — both third-party estimates, with no confirmed project statement at the time of writing.
Read more on Zimbuck: https://zimbuck.com/pages/zimbucknews and join the discussion at https://zimbuck.com/groups/zimbuckmarketnews . Related reading on the site: the crypto wallet security guide in the Crypto Security category.
This article is market news and general information only, not financial advice.
