BTCPay Server developers have urged users to shut down their running instances of the payment-processing software following reports that attackers have drained funds from hot wallets connected to some servers.
The warning raises immediate concerns for businesses and individuals using BTCPay Server to accept and process Bitcoin payments. Hot wallets remain connected to the internet, making them more exposed to remote attacks than offline cold storage. If attackers gain access to a server or its wallet infrastructure, they may be able to transfer available funds without the owner's authorization.
The developers' recommendation to shut down affected instances is intended to limit further exposure while the reported incidents are investigated. However, the full scope of the attack, the number of affected servers, and the total value of potentially stolen funds have not been established in the information currently available.
The incident highlights a broader security challenge for self-hosted cryptocurrency payment systems. Although BTCPay Server gives users greater control over their payment infrastructure, that responsibility also includes securing servers, private keys, wallet configurations, and software updates.
For Bitcoin users and businesses relying on self-hosted payment solutions, the immediate priority is to follow official BTCPay Server security guidance and avoid restarting potentially affected instances until developers provide further instructions. The market impact may remain limited unless the incident expands, but the attack could renew concerns about the security of crypto payment infrastructure.
