BTCPay Server urges shutdowns after hot-wallet drains

BTCPay Server has urged operators to shut down their instances after reports that attackers accessed older installations with administrator privileges and drained connected hot wallets. The project says its investigation has narrowed the suspected attack vector to version 2.4.1 or earlier, but it has not established how the attackers gained access or disclosed the number of compromised servers or total losses. The shutdown request was issued while the team investigated reports of unauthorized withdrawals. Operators were asked to use the .btcpaydown.sh script to take their instances offline. BTCPay Server later identified installations running version 2.4.1, released July 23, 2026, or an earlier version as the suspected targets. The project said it had received no credible reports of hot-wallet drains involving version 2.4.7. That finding does not mean every older installation was compromised. Cofounder Nicolas Dorier said attackers logged in with administrator privileges on affected instances. He and the team have not determined how those credentials or access were obtained. BTCPay Server has asked users who believe their servers were compromised to submit incident details and...