BTCPay Server Urges Immediate Node Shutdowns Amid Wallet Draining Incidents

Operators of self-hosted payment infrastructure face critical security risks following a widespread BTCPay Server vulnerability warning issued by the open-source project's leadership. Developers have urgently instructed users running older node deployments to immediately shut down their instances while investigators analyze ongoing reports of compromised wallets, according to CoinDesk. The sudden alert highlights the ongoing operational challenges associated with managing decentralized merchant gateway infrastructure.

Preliminary statements from the project's creator indicate that the reported balance drains appear to predominantly affect server instances operating on software versions prior to release 2.4.2. At present, the core development team has not published an official estimation of total financial damages, nor have they deployed a comprehensive patch to rectify the underlying attack vector. Administrators have been advised to keep servers fully offline to prevent unauthorized script executions or automated fund transfers.

BTCPay Server is widely recognized as one of the premier non-custodial payment processing solutions within the Bitcoin ecosystem, enabling thousands of merchants and online platforms to accept direct payments without financial intermediaries. Because node operators maintain sovereign custody over private keys and wallet configurations, any security flaw within outdated deployment containers poses an immediate threat to merchant revenue streams and settlement addresses.

Security specialists are actively examining whether the vulnerability stems from misconfigured API access, malicious dependencies, or unauthenticated remote procedure calls within older software releases. In the interim, merchants utilizing automated payment gateways must balance commercial uptime against severe custody risks. The development team is expected to release a detailed post-mortem and remediation update once the root cause is conclusively identified.