The developers of the BTCPay Server payment service have confirmed the unauthorized withdrawal of funds from users' hot wallets. The incident affects specifically those configurations where private keys are stored in a network-connected environment, making them vulnerable to compromise. The project team has initiated an investigation and urged node owners to temporarily shut down their servers until all circumstances are clarified.
What Happened
This concerns a targeted attack on hot wallets — a scenario in which attackers gain access to key material without physical interference in the user's infrastructure. BTCPay Server, being a non-custodial solution for accepting bitcoin payments, has traditionally positioned itself as a tool with an enhanced level of control over funds. However, even such services remain dependent on the correct configuration and security hygiene of the end user.
Recommendations for Node Operators
The service team strongly recommends that node operators not delay shutting down their servers and conduct a configuration audit once the situation stabilizes. The key takeaway for the market: storing significant volumes in the hot circuit remains one of the main operational vulnerabilities for merchants and infrastructure providers. Moving core reserves into cold storage and segmenting hot wallets for operational needs is a basic practice whose neglect regularly leads to losses.
The incident once again raises the question of the balance between the convenience of accepting payments and the level of protection of private keys. For businesses using BTCPay Server, a reasonable step is a temporary return to manual or semi-automatic settlement schemes until the official findings of the investigation are published.
Cryptalist Analysis: Such incidents increase pressure on the non-custodial payment solutions segment and serve as a reminder that infrastructure security remains the weak link even in decentralized scenarios. Cryptalist views what is happening as a signal for institutional operators to reconsider their key storage policies and increase the share of cold storage in their operational processes.