BTCPay Server Urges Shutdown After Reports of Hot-Wallet Sweeps

BTCPay Server lets merchants run their own Bitcoin payment processor instead of relying on a custodial service like BitPay or Coinbase Commerce, trading convenience for self-custody of keys and hot wallets. That self-hosting model puts the burden of patching and maintenance on the operator rather than a company. An August patch had already addressed flaws in the software, but instances left unupdated kept running the vulnerable code that attackers have now exploited.

Operators were told to run ./btcpay-down.sh and take their servers offline immediately, which means merchants using BTCPay cannot process Bitcoin payments until the investigation clears. Anyone running an older, unpatched instance faces the prospect that connected hot wallets have already been swept, with no patch yet to apply and no safe way to restart. Operators now have to check their version, isolate funds, and rotate keys before reconnecting anything.

A tool built to hand merchants full control of their funds has exposed how much that control depends on operators keeping up with updates, something a custodial processor would normally handle for them. The absence of a named affected-version list or a loss figure leaves merchants unable to judge their own exposure, which sits awkwardly against the transparency self-hosted, open-source infrastructure is supposed to offer over closed custodial rivals. (per crypto.news)

The project's next security alert will need to specify which versions are vulnerable and confirm whether the November 2 warning connects to flaws the August patch missed or something new. Until BTCPay names affected releases and discloses total losses, operators have no basis to decide whether restarting with an upgrade is safe, and merchants have no figure to judge how exposed the wider user base has been.