BTCPay Server Urges Merchants to Shut Down Servers After Hot Wallet Attacks Target Older Versions

BTCPay Server, a popular open-source Bitcoin payment processor, is warning merchants to immediately shut down their servers following reports of hot wallet attacks targeting versions 2.4.1 and older. The alert comes just days after the project shipped an emergency patch for a critical vulnerability, but attackers appear to have exploited the flaw before many users could update. The attacks have reportedly drained funds from merchants' connected hot wallets, which are used for automated payouts and refunds. This incident underscores the risks of self-custody and the importance of rapid patching in the Bitcoin ecosystem. BTCPay Server developers have not yet disclosed the number of affected merchants or the total amount stolen, but they emphasize that users running the latest version (2.4.2 or higher) are not vulnerable. The project is advising all users to verify their server version, disable hot wallet features if possible, and monitor for unauthorized transactions. As Bitcoin adoption grows among e-commerce businesses, such security lapses could erode trust in decentralized payment solutions. The coming days will reveal the full scope of the damage and whether BTCPay Server can restore confidence among its user base.