BTCPay, a bitcoin payment tool, tells users to switch off their servers after reports of drained wallets

BTCPay Urges Server Shutdown Amid Wallet Drain Reports

BTCPay, the open‑source Bitcoin payment processor, has issued an urgent advisory for its users to power off any servers running vulnerable versions of the software. The warning follows multiple reports of cryptocurrency wallets being emptied after interacting with BTCPay instances. While the project’s maintainers are still investigating the root cause, they have not disclosed the total amount of funds lost nor provided a concrete fix at this time.

---

What Prompted the Advisory?

Recent incidents surfaced where merchants and service providers using BTCPay experienced unauthorized withdrawals from their Bitcoin wallets. The affected parties reported that the drains occurred after transactions were processed through BTAPy nodes running versions older than 2.4.2. The BTCPay founder confirmed that the reports appear to be tied to these legacy releases, prompting the immediate recommendation to shut down any affected servers until a resolution is confirmed.

Scope of the Issue

• Version exposure: Only installations running versions prior to 2.4.2 are believed to be at risk. Users on the latest release are not directly implicated.
• Impact uncertainty: The project has not released a loss figure, and the number of compromised wallets remains unclear.
• Investigation status: BTCPay’s core team is actively reviewing code, logs, and external reports to pinpoint the vulnerability or potential supply‑chain compromise.

Recommended Immediate Actions

1. Power down servers running BTCPay versions older than 2.4.2.
2. Backup wallet keys and any transaction logs before shutting down the service.
3. Audit recent transactions for unauthorized activity and report any anomalies to the BTCPay community channels.
4. Upgrade to the latest stable release once the project publishes a security patch or confirms the issue is resolved.
5. Monitor official communications on BTCPay’s GitHub repository and mailing lists for updates.

How to Upgrade Safely

• Pull the latest code from the official repository rather than third‑party mirrors.
• Verify signatures of release assets to ensure authenticity.
• Test the upgrade in a staging environment before deploying to production.
• Review configuration changes introduced in the new version to avoid regressions.

---

Looking Ahead

The BTCPay incident underscores the importance of maintaining up‑to‑date software in the cryptocurrency ecosystem, where even minor version gaps can expose users to significant risk. While the open‑source community typically benefits from rapid patch cycles, this event highlights the need for proactive monitoring and swift response mechanisms.

Stakeholders are encouraged to stay engaged with BTCPay’s development channels, contribute to the investigation where possible, and adopt best practices for key management and server hardening. As the investigation progresses, further details on the cause—whether a code flaw, configuration error, or external attack—will shape the remediation roadmap.

---

Bottom line: If you are running BTCPay on a version older than 2.4.2, shut down the server immediately, secure your wallet assets, and prepare to upgrade once the project releases a definitive fix.