BTCPay Server urged all operators to take their instances offline on Sunday after reports emerged that unauthorized parties had gained access to and drained hot wallets connected to the Bitcoin payment platform.

In an announcement on X, the project asked every instance administrator to take their server offline using the shutdown command and wait for its investigation to conclude.

“We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers. If you’re running an instance, please shut it down (./btcpay-down.sh) until we complete the investigation,” BTCPay Server said on X.

Because BTCPay Server is self-hosted, the responsibility for shutting down falls squarely on the owners of individual servers. The project has not yet disclosed the root cause of the incident, how many servers were affected, or the total amount stolen.

Why hot wallets are exposed

According to BTCPay Server’s documentation, the hot-wallet functionality stores the seed directly on the server for signing transactions and enables fast payouts without relying on external hardware. That convenience, however, has made hot wallets considerably more vulnerable than cold storage.

Hot wallets keep private keys on internet-connected systems, so attackers who compromise the underlying infrastructure can gain access to them. Cold wallets, by contrast, store signing keys offline. The trade-off is speed: hot wallets prioritize convenience and allow merchants to process transactions more quickly, while cold wallets favor security.

For businesses using BTCPay Server to accept Bitcoin payments, a compromised hot wallet could expose funds intended for merchant settlements or customer transactions. The warning therefore raises questions about how operators can balance payment convenience with the need to protect private keys against unauthorized access.

Samson Mow, CEO of BTC technology company JAN3, commented on the incident: “I think it should be a priority to get SamRock working with Indra ASAP so users of BTCPay can receive directly to Aqua Bitcoin and swap to cold regularly.”

Third security incident in recent months

The shutdown call is the third security incident to hit the project in quick succession. Just days earlier, on October 29, BTCPay Server released an emergency update, version 2.4.7, to address this vulnerability and others.

In August, attackers exploited a separate security loophole, leading to the theft of Lightning Network keys and the draining of multiple associated nodes, including one belonging to Foundation, a manufacturer of hardware wallets. At the time, BTCPay Server assured users that their standard on-chain wallets and built-in hot wallets were safe from that attack. It nevertheless asked users to update their servers to version 2.4 or, at least temporarily, disable their instances until they could do so, reducing the risk of unauthorized access.

Until the current investigation is complete, operators are advised to review their server activity, wallet balances, and transaction histories for any suspicious movements. Those who suspect their hot wallets have been compromised should not continue to use potentially exposed signing keys. The incident also underscores why backups need to be kept secure and why large Bitcoin balances should be held offline rather than in wallets connected to payment infrastructure. With the root cause, the number of affected servers, and the total amount stolen all still undisclosed, the conclusion of BTCPay Server’s investigation is the immediate development for the platform’s merchants and operators to watch.

Coldcard exploit caused at least $116 million in losses

The wider industry has faced similar troubles. In August, Coldcard, a popular manufacturer of Bitcoin-only wallets, was hit by an exploit that has resulted in at least $116 million in confirmed losses so far.

According to Blockaid CEO Ido Ben-Natan, the Coldcard incident exposed a fundamental weakness in crypto: reliance on private keys that can become a single point of failure.

“It’s a single-use kind of access to these things. Now there’s beauty in that no one else can go in and have access to these things. The hardship in that is that it is a single point of failure,” Ben-Natan said.

He added: “The learning here is that having your assets sit somewhere and forgetting about them and not thinking about them is not actually the solution because the pace of security is evolving. You have to either kind of constantly be paranoid or either outsource that decision-making process to someone else.”

The exploit originated from a serious firmware bug that allowed corruption of the wallet-seeding procedure on Coldcard devices. The flaw removed the randomizing factor needed to create secure wallets, enabling attackers to calculate the private keys and empty the wallets of their Bitcoin. More than 7,000 addresses were affected, according to research firm K33.

The pattern is industry-wide: on average, almost three-quarters of the money stolen from crypto exploits in the first half of 2026 has been related to private key breaches.