BTCPay Server issues emergency shutdown warning amid hot wallet attacks

BTCPay Server on Sunday told operators of its self-hosted Bitcoin payment software to take their instances offline after intruders gained access to and drained hot wallets. The project said administrators should run its shutdown command while it investigates, but it has not disclosed the cause, how many servers were affected or how much was stolen. The warning follows an October 29 emergency update, version 2.4.7, and an August exploit that stole Lightning Network keys and drained associated nodes, including one belonging to hardware-wallet maker Foundation. Hot wallets store private keys on internet-connected servers, making them more exposed than offline cold storage.