BTCPay Server receives report of hot wallet attack, advises users to shut down instances

BTCPay Server, the open-source Bitcoin payment processor, announced on November 2 that it received reports of unauthorized attackers draining funds from hot wallets connected to BTCPay Server instances. The team advised all users running instances to shut down their servers pending the completion of an investigation, providing the shutdown command ./btcpay-down.sh for operators to execute. The incident affects self-hosted deployments of the payment protocol, which merchants and processors use to accept Bitcoin payments directly. The full scope of the exploit, including total funds lost and the number of affected instances, has not yet been disclosed. Operators and merchants should monitor BTCPay Server's official channels for the investigation's findings and remediation guidance before bringing instances back online.