BTCPay Server Urges Immediate Shutdown Amid Hot Wallet Attacks

Story

BTCPay Server, an open-source Bitcoin payment processor, has issued an urgent warning for its operators to shut down their instances. This action follows reports of unauthorized withdrawals from hot wallets. The attacks primarily target installations running version 2.4.1 or earlier, which was released on July 23, 2026. The latest version, 2.4.7, appears unaffected by these incidents, and users are urged to update immediately. The project has not disclosed the number of affected operators, the amount of cryptocurrency lost, or the technical mechanisms of the attack. Neither has it released a patch nor specified a version limit for the vulnerability. This incident underscores the persistent security risks associated with self-hosted hot wallets and the importance of timely software updates in the decentralized ecosystem. The lack of specific details on the attack vector and affected versions, leading to a blanket shutdown recommendation, highlights the severity and ongoing investigation. While a significant security event for BTCPay users, the structured market context does not show a direct, broad market impact from this specific incident. Bitcoin's price is stable around $78,020, suggesting this is a localized issue rather than a systemic market mover.