BTCPay Server Reports No Wallet Drains on Latest Release After Asking Merchants to Go Offline

BTCPay Server, the open-source bitcoin payment processor, reported no wallet drains following a security incident that prompted the project to ask merchants to take their instances offline. Founder Nicolas Dorier said the attacker logged in as admin on instances running versions before 2.4.2, and the project later said its investigation had pinned down the attack vector. The incident affects self-hosted BTCPay Server deployments used by merchants to accept bitcoin payments, where compromised admin access could have exposed funds. No specific loss figures were disclosed, and the project confirmed the latest release is not affected. Merchants and node operators should watch for patched releases and guidance on upgrading from pre-2.4.2 versions, as well as any further details from the ongoing investigation into how the attacker obtained admin credentials.