BTCPay Server has warned operators about a security incident involving unauthorized access to hot wallets.
The attack has raised concerns about the safety of Bitcoin funds held on self-hosted payment infrastructure.
The project has urged administrators to take their instances offline while its team investigates the breach. However, the extent of the incident remains unclear, leaving operators without confirmed details about potential losses.
BTCPay server orders emergency shutdown amid hot wallet attacks
BTCPay Server issued an emergency warning on Sunday after receiving reports of attackers accessing and draining hot wallets. The project urged all instance administrators to shut down their servers immediately using the ./btcpay-down.sh command.
In its announcement on X, BTCPay Server stated: “We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers. If you’re running an instance, please shut it down (./btcpay-down.sh) until we complete the investigation.”
Since BTCPay Server operates as a self-hosted payment platform, individual administrators must shut down their instances. The project has not disclosed the attack’s root cause, the number of affected servers, or the total amount stolen.
According to its documentation, BTCPay Server’s hot-wallet functionality stores wallet seeds directly on the server. This allows the platform to sign transactions and process faster payouts without external hardware.
However, storing private keys on internet-connected infrastructure creates additional security risks. Attackers who compromise the underlying server may gain access to signing keys and transfer funds without authorization.
Unlike cold wallets, which keep signing keys offline, hot wallets prioritize accessibility and transaction speed. Consequently, businesses accepting Bitcoin payments through BTCPay Server could face losses involving merchant settlements and customer transactions.
Recent security incidents raise further concerns
The latest BTCPay Server warning follows two other security incidents involving the project. On October 29, the team released emergency update version 2.4.7 to address a vulnerability and additional security issues.
Earlier, in August, attackers exploited another security loophole involving Lightning Network keys. The incident resulted in the theft of keys and drained multiple associated nodes, including one belonging to Foundation, a hardware wallet manufacturer.
At the time, BTCPay Server assured users that the incident did not compromise their standard on-chain wallets or built-in hot wallets. Nevertheless, the project advised administrators to upgrade to version 2.4.
It also recommended temporarily disabling affected instances until operators could complete the update. These precautions aimed to reduce exposure to unauthorized access.
Following Sunday’s warning, Samson Mow, CEO of Bitcoin technology company JAN3, suggested an additional security approach. He advised BTCPay Server to prioritize integrating SamRock with Indra.
Mow said the integration could allow users to receive payments directly through Aqua Bitcoin and regularly swap funds into cold storage.
Meanwhile, operators should review server activity, wallet balances, and transaction histories for suspicious movements. Anyone suspecting a compromise should avoid reusing potentially exposed signing keys.
Coldcard exploit highlights private key security risks
The BTCPay Server incident also follows an August exploit involving Coldcard, a manufacturer of Bitcoin-only hardware wallets. The attack has reportedly caused at least $116 million in confirmed losses.
Blockaid CEO Ido Ben-Natan said the incident exposed the risks associated with private keys becoming a single point of failure.
He explained that private keys provide exclusive access to crypto assets but create significant risks when attackers compromise them.
Ben-Natan also argued that storing assets without regularly reviewing their security creates additional exposure. He suggested that users must continuously assess security risks or outsource those decisions.
The Coldcard exploit originated from a firmware bug that corrupted the wallet-seeding procedure. This removed the randomization required to generate secure wallets, allowing attackers to calculate private keys and drain Bitcoin holdings.
Research firm K33 reported that more than 7,000 addresses suffered exposure. Additionally, nearly three-quarters of the funds stolen through crypto exploits during the first half of 2026 involved private key breaches.
For BTCPay Server operators, the latest warning reinforces the importance of secure backups and offline storage. Keeping large Bitcoin balances away from internet-connected payment infrastructure could reduce exposure to similar attacks.
