BTCPay Server Urges Immediate Shutdown Following Reports of Drained Hot Wallets

BTCPay Server has instructed operators to shut down their self-hosted instances following reports that attackers are draining funds from connected hot wallets. Founder Nicolas Dorier stated that compromises appear to target deployments running versions older than 2.4.2, where attackers obtained administrator access to sweep funds. The advisory comes after an October 29 release of version 2.4.7, which patched 85 vulnerabilities, and an August exploit affecting Lightning Network credentials. Merchants including Coincards have taken payment processing offline, while total financial losses and the exact attack vector remain undisclosed.