Hot Wallets on Self-Hosted Payment Servers Are Being Swept: What the BTCPay Incident Means for Small Teams

On November 1, the open-source Bitcoin payment processor BTCPay Server issued an alert: it is receiving reports of hot wallets on multiple self-hosted instances being swept by unauthorized attackers, and it asked operators to run the shutdown script until the investigation is complete.

The founder later added that the reports involve versions older than 2.4.2, that the attacker logged in as an administrator on those instances, and that how they obtained that access is still under investigation. The project's public servers, running 2.4.7, were not attacked. BTCPay had shipped 2.4.7 as an emergency update on October 29, fixing one critical and several medium-severity vulnerabilities. The number of affected instances and the losses have not been disclosed.

Where small teams are exposed

Five things you can do now

• If your team runs BTCPay, shut it down today as the project advises and check the version. Upgrade to the latest release before bringing it back
• Review the admin user list and login history. Treat any unknown admin or unfamiliar IP as an incident and move the remaining hot wallet balance to a new address first
• Avoid hot wallets where you can. Receive into a watch-only wallet that holds only public keys, and sign on an offline device or a multisig. If you must use a hot wallet, keep only what you need for the day and sweep the rest to cold storage on a schedule
• Keep the payment system's admin panel off the public internet. Reach it only through a VPN or zero-trust gateway, with two-factor authentication enforced
• Subscribe to the security advisories of every self-hosted system you run, apply emergency updates within 48 hours, and name one owner for it

The shutdown advice, affected version range and admin logins come from public statements by BTCPay Server and its founder. How the attacker obtained admin access, the number of affected instances and the losses have not been disclosed, and this article does not speculate. This article does not cover attack details.