BTCPay Server Tells Merchants to Shut Down After Attackers Sweep Hot Wallets: Are Payments Still Safe?

In today’s Bitcoin news, BTCPay Server, the free open-source payment processor many Bitcoin merchants run themselves, told every operator to shut down their instance after reports that attackers were sweeping the hot wallets on merchant servers. Less than six hours later, the culprit was old software. At 04:07 UTC on Monday, the project said its investigation had found an attack vector aimed at servers running version 2.4.1, released on July 23, or older. It has “no credible reports” of drains on the current 2.4.7. BTCPay has not said how much was stolen or how many stores were hit.