BTCPay Server issued an emergency shutdown warning on Nov. 1 after reports that attackers were draining bitcoin from hot wallets tied to self-hosted payment servers. Founder Nicolas Dorier linked the reported compromises to BTCPay Server versions predating 2.4.2. Public servers running version 2.4.7 had not been attacked, he said.
What older installs are up against
The warning centers on self-hosted payment servers — the setups merchants run themselves to accept bitcoin without a middleman. Hot wallets connected to those servers hold funds online, which makes them a live target once an attacker finds a way in. Dorier's message points at old code as the way in: anything before 2.4.2 is in the blast radius.
That's a wide net. BTCPay Server is open-source and free, so the installed base isn't tracked the way a hosted service's is. Anyone who set up a server years ago and never touched it could still be running a pre-2.4.2 build today.
The three-day gap
The shutdown warning landed three days after an unspecified prior event, according to the information available. The source material truncates the details of that earlier incident, so it isn't clear from the record whether it was a related compromise, a disclosure, or something else. What is clear is the sequence: something happened, and three days later BTCPay Server told operators to shut down.
Emergency shutdown notices are blunt instruments. They trade uptime for safety, and for a payment processor that means merchants who rely on the server for checkout lose it until they deal with the problem.
Version 2.4.7 held up
One concrete piece of good news: public servers on version 2.4.7 had not been hit, per Dorier. That draws a line between the current release and the older builds the compromises are tied to. It also suggests the fix, or at least the hardening, is already on the newer branch.
For operators, the practical read is straightforward. Check the version. If it's below 2.4.2, the warning applies. If it's 2.4.7, the reported attacks didn't reach it.
What operators are being asked to do
The warning is a shutdown notice, not a patch announcement. BTCPay Server hasn't, in the available facts, published a remediation timeline or a full accounting of which servers were affected and how much bitcoin was taken. The number of compromised servers, the size of the losses, and the identity of the attackers all remain unknown from the public record so far.
The next thing to watch is whether Dorier or the project follow up with a postmortem covering the earlier event and the wallet drains, and whether an updated release is pushed for operators still on pre-2.4.2 builds. Until then, the safest position for anyone running an old self-hosted server is the one the notice already states: shut it down.
