Hot wallet sweeps reported on Sunday have been connected to servers running outdated versions of the BTCPay Server platform, according to founder Nicolas Dorier. The attacks appear to target instances running releases older than 2.4.2, raising urgent concerns among operators and the broader bitcoin merchant community.
Attacks target outdated server software
BTCPay Server is an open-source bitcoin payment gateway widely used by merchants for processing cryptocurrency transactions. On Sunday at 5:25 p.m. ET, the BTCPay team issued an alert urging users to immediately shut down any running instances using the script ./btcpay-down.sh until more information became available about the breach.
Approximately two hours later, Dorier confirmed that only servers running releases earlier than 2.4.2 had been compromised. He clarified that the project’s public servers, operating on version 2.4.7, remained unaffected by the incident.
Dorier stated the team had evidence of exploits against vulnerabilities present before the 2.4.2 release. Subsequent investigation revealed the primary attack vector specifically targeted servers running version 2.4.1, released on July 23, or any earlier edition.
BTCPay’s own infrastructure running on version 2.4.7 did not experience any breach, and there have been no credible reports of drained hot wallets from users up-to-date with this release.
Operators who have updated their systems at least once since the 2.4.2 release are considered safe from the recent attack, Dorier noted. He urged users not to keep excessive funds in a hot wallet and announced that detailed preventive guidance would be published soon.
Several hosting providers took proactive steps by automatically shutting down vulnerable instances to prevent further exploitation. BTCPay publicly thanked LunaNode and other service providers for their swift response.
The BTCPay team has asked incident victims to send detailed server logs and information to its security team to assist with the ongoing investigation.
Recent attack affects wallets previously deemed secure
BTCPay Server functions as a self-hosted platform, which means only server operators—not the BTCPay team—can control or shut down merchant servers. In hot wallet mode, the payment gateway signs transactions using a seed stored directly on the server, putting funds at risk if unauthorized parties gain access.
The vulnerability timeline traces back to August, when BTCPay released version 2.4.2 to address a critical flaw that was being exploited. Previous versions, including initial 2.4.2 candidates, allowed attackers to steal Lightning Network Daemon (LND) macaroon credentials and gain unauthorized control of Lightning nodes.
Craig Raw, developer of Sparrow Wallet, as well as Foundation and Citadel21, reported attacks on their Lightning nodes around the same period. The patched version of BTCPay automatically regenerated LND’s macaroons, but operators running older versions with exposed Lightning nodes were required to manually update credentials for full protection.
A separate TOTP two-factor authentication bypass via the Greenfield API’s Basic Authentication was also resolved in the 2.4.2 update. BTCPay clarified that this bug was unrelated to the macaroon exploit.
Although BTCPay’s advisory previously stated its own on-chain wallets were not affected during the August incident, Sunday’s events showed that hot wallets are still vulnerable if servers are not kept current. BTCPay and Dorier have not yet confirmed whether the latest attacks exploited the August macaroon bug or another vulnerability predating version 2.4.2.
Following the August attack, supporters established a bounty of up to 3 BTC for any recovery of lost funds, representing 10% of any assets returned.
River, a bitcoin payments company, reported that average merchant usage of bitcoin increased by 74% in 2025, with Lightning Network transaction volume surpassing $1 billion monthly.
Mini dictionary: BTCPay Server is an open-source payment processor allowing merchants to accept bitcoin and cryptocurrencies through self-hosted infrastructure. The platform emphasizes user control but requires diligent security updates for safe operations.
| BTCPay Server Version | Release Date | Attack Vulnerable? |
|---|---|---|
| 2.4.1 or earlier | July 23 or before | Yes |
| 2.4.2 | August 7 | Patched, still risk if not fully updated |
| 2.4.7 | October 29 | No |
