BTCPay Server hot wallets under active attack; operators advised to shut down instances immediately.
Security & Exploits ·
BTCPay Server instances are experiencing active exploitation targeting their hot wallets. According to security monitoring, attackers are withdrawing funds from multiple affected deployments. Operators have been advised to take their systems offline as an immediate protective measure.
The breach appears to span across numerous BTCPay Server installations rather than a single instance. Security researchers are currently attempting to trace the addresses involved in the fund movements, though the full scope of compromised wallets and total losses remain under investigation.
The nature of the vulnerability—whether tied to a specific code flaw, key exposure, or operational misconfiguration—has not yet been disclosed. No timeline for a patch or detailed technical analysis has been made available, leaving operators to make shutdown decisions with limited clarity on the root cause or whether their particular deployment is at risk.