BTCPay Server has asked operators to shut down their instances after receiving reports that unauthorized attackers were draining hot wallets. The project’s November 1 alert instructed operators to run ./btcpay-down.sh and keep instances offline until its investigation is complete, according to The Defiant’s report republished by Crypto News.
For merchants running the open-source Bitcoin payment processor, following the containment request means interrupting their payment infrastructure.
Operators Receive a Shutdown Instruction
The alert gave no confirmed loss amount, affected-instance count, vulnerable-version list, or patch announcement. Its shutdown request was not restricted to a particular software version, leaving operators unable to identify a version that the project has declared safe to keep running.
Because BTCPay is self-hosted software, individual operators must carry out the instruction at each deployment. Merchants must decide whether to keep checkout available or follow the developer’s request to stop their instances while the investigation proceeds.
The shutdown is a precaution during an investigation, not a procedure for recovering funds already reported stolen.
Server-Side Signing Puts Funds Within Reach
BTCPay’s wallet documentation explains how hot wallets handle signing. When an operator enables a hot wallet, the software can use a seed stored on the server to sign transactions. Spending can therefore happen without an external signing device.
That convenience puts spending authority on the same machine running the payment software. If an attacker obtains that authority, funds can be spent without the merchant approving a transaction on separate hardware. This is the custody tradeoff relevant to the reported drains, although the current attack method remains undisclosed.
BTCPay also supports hardware-wallet signing and partially signed Bitcoin transactions, or PSBTs. In the documented PSBT workflow, an unsigned transaction is exported, inspected and signed in a compatible wallet, then imported into BTCPay for completion and broadcast.
These signing arrangements do not exempt an instance from the shutdown request, which extended beyond hot-wallet configurations.
August’s Fix Addressed Stolen Lightning Credentials
BTCPay dealt with a separate theft incident in August. In its August 10 response, the project said attackers had obtained LND admin macaroon credentials from affected instances and used them to access connected Lightning wallets.
Its remediation then was specific: updating to BTCPay Server 2.4.2 also updated LND and regenerated its admin macaroon.
The November alert did not identify a connection to that earlier vulnerability. Operators therefore have no basis in the alert for treating the August update as a remedy for the newly reported hot-wallet drains.
Overview
BTCPay has requested that operators take their instances offline pending investigation of reported hot-wallet drains. The alert specifies ./btcpay-down.sh as the shutdown command and gives no confirmed loss total, affected-version list or patch announcement.
