BTCPay Server Hack Drains Hot Wallets Days After Binance

BTCPay Server is an open-source, self-hosted Bitcoin payment processor that merchants run on their own servers instead of trusting a custodial processor like BitPay or Coinbase Commerce. That self-hosting model, prized for giving shop owners direct control of hot wallets, also means each operator is responsible for patching. The project's November 1 alert told every operator to shut down, a response it later narrowed to installations on version 2.4.1 and earlier.

Merchants still running pre-2.4.1 builds face a binary choice: take instances offline immediately or risk further drains from hot wallets attackers can already reach with administrator access. Unlike Binance customers in a separate incident days earlier, BTCPay merchants have no exchange-style reserve fund to make them whole, so losses sit with whoever ran the server. Upgrading to 2.4.7 becomes mandatory, not optional, for anyone still accepting Bitcoin through the software.

Self-hosted doesn't mean risk-free; non-custodial tools shift custody risk from an exchange to whoever operates the software, and an unpatched admin-access flaw shows that control without disclosure of the entry point is a fragile promise. BTCPay's appeal rests on merchants not trusting a middleman, but that trust now depends on operators applying security updates as diligently as the custodians they rejected. The project has not disclosed how attackers obtained administrator access, leaving open whether the fault is a code vulnerability or operator misconfiguration.

BTCPay Server has not published total losses or the exact method intruders used to gain administrator access, and both disclosures will determine whether this becomes a single-vendor patch note or a wider audit of self-hosted Bitcoin payment software. Confirmation that no theft reports exist for version 2.4.7 will need to hold up as more operators migrate; any report of a drain on the current release would reopen the question BTCPay says it has closed.