BTCPay Advises Shutting Down Servers Amid Reports of Funds Moved From Hot Wallets
Key Facts
The BTCPay Server project advised server operators to shut them down while it investigates reports of funds being moved from hot Bitcoin wallets, according to an alert cited by The Defiant. The guidance comes amid reports that unauthorized attackers accessed funds in those wallets, with the project yet to disclose how the breach occurred or its cause. The alert urged operators to run the command "./btcpay-down.sh" to shut down their servers. It did not limit the recommendation to a specific software version, and no fix for the incident has been announced. That leaves server operators with a general precautionary measure until the project completes its investigation.
The alert did not identify which versions may be affected, so version 2.4.7 is not established as immune to the current attacks. That release addressed 85 security findings identified in a scan, distributed according to the original report's classification as one critical, 13 high, 52 medium and 19 low. The remediation shows the scope covered by the release, but does not establish its connection to the current reports. The release history also does not in itself confirm that any particular version is safe from the current incident. The project's instruction to shut down servers remains the announced measure during the investigation.
The current alert differs from a previous BTCPay Server vulnerability fixed in version 2.4.2 on August 7, 2026. That vulnerability allowed a remote attacker, without authentication, to obtain Lightning Network Daemon (LND) node credential files, according to the project's official blog. BTCPay said those credentials could have enabled control of the node and movement of funds. The project confirmed that the vulnerability had been exploited and that users were affected and had funds stolen. But the review of the previous incident tied the risk to LND nodes and did not attribute any impact on BTCPay's on-chain wallets to that vulnerability.
In its explanation of the previous incident, BTCPay said attackers targeted files ending in ".macaroon" and that its on-chain wallets, including hot wallets, were not affected by that vulnerability. It added that funds in an LND on-chain wallet may have remained at risk because the threat involved the affected LND node. On that basis, the project then advised LND users running versions earlier than 2.4.2 to update immediately or keep their server offline until they could update. The current reports, by contrast, concern funds moved from hot wallets, and the project has not said they resulted from the previous vulnerability. The current alert did not identify a cause or a mechanism linking the two incidents.
In its statement on the August incident, the project said attackers extracted administrative credentials for LND nodes from affected servers and used them to access the connected node wallets. It said updating BTCPay Server to 2.4.2 also updates LND and regenerates the administrative credentials. Those steps were part of a specific response to a credential vulnerability; the alert on the current incident provides no similar guidance or new fix. The project also announced on August 10 that it would strengthen code scanning and review in collaboration with external parties. It said it would prioritize security updates and hardening over new features for the foreseeable future.
According to the project's official repository, BTCPay Server is free, open-source software for processing Bitcoin payments, run by users on self-hosted servers. The software allows merchants to accept Bitcoin directly, without fees or intermediaries, while each operator manages their own server. This model means the shutdown guidance reaches operators of infrastructure they manage directly, rather than being limited to users of a single centralized service. In its August response, the project said supporters had pledged to fund a bounty for recovering stolen funds, equal to 10% of the amount recovered and capped at 3 BTC if all funds were recovered. The current alert did not announce a similar measure or a timeline for the investigation to conclude.