BTCPay Server Reports No Wallet Drains on Latest Release After Asking Merchants to Go Offline

Introduction

Recent reports of hot‑wallet drains on BTCPay Server instances prompted the project’s maintainers to ask merchants to temporarily take their servers offline. The incident, which targeted installations running version 2.4.1 or earlier, has since been clarified: no credible drains have been observed on the current 2.4.7 release, and the attack vector remains under investigation. This article outlines what is known, why updating matters, and steps operators can take to protect their funds.

What happened and how it was discovered

• Initial alert: BTCPay Server posted on X that some merchants were experiencing unauthorized sweeps of hot wallets. The message included a shutdown script for operators to run while the team investigated.
• Founder’s follow‑up: Nicolas Dorier, BTCPay’s founder, confirmed that the project’s own public nodes (running 2.4.7) were not compromised and that the attacker had gained admin access on older installations.
• Investigation update: A later BTCPay post identified the vulnerable range as versions 2.4.1 and older. No concrete details about the exploit were released, but the team emphasized that the latest release showed no evidence of wallet drains.

Why older versions are at risk

The attack differs from the August 2024 incident, which exploited a flaw that exposed Lightning node credentials. This time, the entry point appears to be an admin‑level login, allowing the attacker to move funds stored directly in hot wallets on the server. Versions prior to 2.4.2 lack the security hardening introduced in later releases, making them susceptible to credential‑theft or session‑hijacking techniques that grant elevated privileges.

Practical steps for merchants

1. Upgrade immediately – Ensure your BTCPay Server is running version 2.4.7 or later. The upgrade process is documented in the official repository and typically involves pulling the latest Docker image or rebuilding from source.
2. Run the shutdown script – If you are still on a vulnerable version, execute the script provided by BTCPay to pause payment processing while you assess the situation.
3. Review admin access – Audit all admin accounts, enforce strong, unique passwords, and enable two‑factor authentication where possible.
4. Monitor wallet activity – Set up alerts for any outbound transactions from hot wallets. Consider moving large balances to cold storage until you are confident the system is secure.
5. Submit logs – If you suspect your instance was targeted, email the relevant logs to BTCPay’s security team as requested in their post. Sharing data helps the community refine defenses.

Looking ahead

While BTCPay Server has not published a formal security advisory beyond the X posts, the rapid communication and clear guidance demonstrate a proactive response. Merchants should treat this episode as a reminder that open‑source payment infrastructure requires diligent version management and robust access controls. Keeping software up to date remains the most effective defense against emerging threats.

--- This article was prepared with AI assistance and reviewed by the Unchained editorial team for accuracy and clarity.