BTCPay Server tells operators to shut down after reports of hot wallets being drained

BTCPay Server, the open-source software many merchants use to accept Bitcoin payments without a third-party processor, has told operators to shut down their instances after receiving reports that hot wallets on multiple servers were being drained by unauthorized attackers.---Adding to concerens re the drain last week:investingLive Asia-Pacific market news: Binance hack shakes crypto---In a post on X, the project asked anyone running an instance to take it offline with its shutdown command until the investigation is complete. BTCPay has not yet disclosed the cause of the attack, how many servers were affected or how much was taken.A hot wallet is one whose private keys sit on an internet-connected server, so it can send funds automatically, for example to pay out refunds. That convenience makes it a bigger target than offline storage. The incident involves software built around Bitcoin, not the Bitcoin network itself.The warning follows two recent security events at the project. On October 29, BTCPay released emergency version 2.4.7 to fix one critical and several medium-risk vulnerabilities. In August, attackers exploited a separate flaw to steal Lightning Network credentials and drain nodes running behind BTCPay, including one operated by hardware wallet maker Foundation. At that time, BTCPay said its standard on-chain wallets, including hot wallets created inside the software, were not affected.That makes the latest reports notable, because they point to the type of wallet that was outside the scope of the August flaw. BTCPay has not said whether the new attacks are linked to the vulnerabilities fixed last week.What to watch nextThe key questions are whether BTCPay ties the attacks to a specific software version, and whether servers running the October 29 update were affected. Loss figures and reports from named merchants will show the scale of the problem. In August, BTCPay narrowed the scope considerably after its first alert, so the initial warning may not reflect the final picture. Until the project gives an all-clear, operators holding funds in a BTCPay hot wallet should follow its shutdown advice. This article was written by Eamonn Sheridan at investinglive.com.