BTCPay Server, open-source software that lets businesses accept bitcoin payments on their own servers, asked users on Sunday to shut them down after reports that attackers were draining hot wallets, CoinDesk reports. Founder Nicolas Dorier said the cases appear to involve releases older than 2.4.2 and that the attackers logged in as administrators, although it is not known how. No loss figure or fix has been given. In August a different flaw that allowed theft of funds was fixed in version 2.4.2.
What it means: BTCPay is popular precisely because there is no intermediary: the merchant collects payments straight into their own wallet. That same feature means security depends entirely on how well each owner maintains their server, and there is no central switch when something goes wrong. The hot wallet option, where the seed phrase sits on the server so payments can be signed automatically, is convenient but turns any server breach into an immediate loss of money. Greek businesses accepting bitcoin with this software should follow the advice, check the version and administrator accounts, and move balances to a wallet that does not live on a connected machine. Best practice is for the server to know only the public key, so it can generate receiving addresses, with withdrawals signed on a separate device. Choosing between a self-hosted setup and a MiCA-licensed provider is essentially a choice between control and handing over security responsibility, and it should be made deliberately.
Related service: Consulting
Related stories
- Samsung Wallet launches USDC Stablecoin Account on Solana for eligible US users
- FATF report: virtual assets are a core laundering channel for scam compounds
- ECB’s Cipollone: digital euro pilot in H2 2027, potential issuance 2029
- USDC: 12 November EBA reserve oversight handover approaches
- Jupiter lists Asian equity perpetuals on Solana using Chainlink data