BTCPay Server Urges Shutdown After Reports of Hot-Wallet Sweeps

BTCPay Server, the open-source, self-hosted bitcoin payment processor, has urged all operators to shut down their instances via the ./btcpay-down.sh script following reports of hot-wallet sweeps, an incident that raises fresh security concerns for merchants and self-custodial payment infrastructure built on bitcoin. The advisory, issued while the project investigates the reports, did not identify affected versions, confirm the scope of the compromise, or announce a patch, leaving operators without a clear remediation path beyond taking systems offline. Because BTCPay is widely used by merchants and nonprofits to accept bitcoin without third-party custodians, any hot-wallet exposure directly threatens on-chain funds and merchant revenue, and the shutdown guidance effectively halts payment processing for affected deployments. No dollar figures for swept funds, affected instance counts, or exploit volumes have been disclosed, and the project has not said whether the issue lies in the core software, Docker deployments, or third-party integrations. Operators and the broader bitcoin payments ecosystem should watch for the project's next advisory confirming root cause, affected versions, a patched release, and guidance on when it is safe to bring instances back online and rotate keys.