BTCPay Warns Merchants to Shut Down Servers After Hot Wallet Attacks

BTCPay Server reportedly told users to power down their instances after attackers started draining hot wallets on some servers. For merchants running bitcoin payments through self-hosted infrastructure, the point is simple: if the server is compromised, the wallet can move funds without asking anyone first.

1. According to a Monday, November 2 report from CoinDesk, BTCPay urged users on Sunday, November 1 to shut off their servers after reports that unauthorized attackers were sweeping funds from hot wallets on BTCPay instances.
2. BTCPay’s open-source software lets merchants run bitcoin payments on their own servers, without middlemen. That also means each business controls its own setup, including hot wallets that stay connected to the internet — and there is no central operator with a master switch to disable every instance at once if something goes wrong.
3. BTCPay said in a post on X: “We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers. If you’re running an instance, please shut it down (./btcpay-down.sh) until we complete the investigation.”
4. The episode lands after a string of attacks on cold wallets, which store private keys but are not connected to the internet. CoinDesk pointed to a software flaw in Coinkite devices this summer and a more recent attack in which hackers drained $90 million from devices made by Ledger.
5. The BTCPay incident also followed last week’s record-setting hack on crypto exchange Binance, where attackers stole more than $6 billion, the largest such exploit in the history of the crypto sector.