BTCPay Server Issues Emergency Warning Over Hot Wallet Drains

Open-source payment infrastructure project BTCPay Server has issued an urgent advisory regarding an active BTCPay Server vulnerability affecting operators hosting obsolete software versions. Merchant administrators and node runners were advised to immediately disconnect vulnerable instances to prevent unauthorized actors from siphoning funds stored within connected hot wallets. The alert comes amid confirmed reports of automated exploits targeting internet-facing nodes running legacy code.

As reported by Cointelegraph, the vulnerability specifically endangers automated payment setups that maintain direct private key access on the server instance. Security contributors emphasized that hot wallets configured within unpatched environments are at immediate risk of total depletion if left exposed to public networks. Operators were instructed to halt their server daemons, secure remaining funds, and initiate mandatory software upgrades before resuming standard merchant checkout operations.

Self-hosted payment gateways represent a cornerstone of decentralized commerce, enabling merchants to accept digital assets directly without third-party intermediaries. However, retaining full operational custody requires constant maintenance, infrastructure hardening, and prompt patching against emerging remote exploit vectors. The ongoing incident highlights the delicate operational balance merchants must manage between automated payment settlement convenience and custody exposure.

Security teams are continuing to analyze the specific exploit path to determine how attackers located and targeted legacy instances. In the meantime, node operators are urged to audit their infrastructure logs, rotate administrative credentials, and adopt hardware or multi-signature signing configurations for commercial operations to eliminate single points of failure.