BTCPay Server told users to shut down after attackers began emptying hot wallets. If you run one to take bitcoin, the money in it may be at risk.
BTCPay Server, a free tool that lets businesses accept bitcoin payments, asked its users on Sunday, Nov. 1, to shut down their servers. CoinDesk reported on Nov. 2 that attackers are draining hot wallets on some of them.
BTCPay said on X that it was receiving reports of hot wallets being swept by unauthorized attackers. A hot wallet is a crypto wallet that stays connected to the internet. BTCPay asked anyone running an instance to shut it down until its investigation is complete.
The software is open source, so anyone can run it on their own server. There is no middleman, and payments go straight into the merchant's own wallet. Those servers can also send coins without the owner approving each move. If someone breaks in, they can send the money to their own address. BTCPay cannot switch servers off itself, so it can only ask each owner to do it.
The warning is for people and businesses who run their own BTCPay Server, especially those keeping funds in hot wallets. If you do not run one, the report gives no sign that you need to do anything. The steps for server owners are in the alert box above.
The report does not say how the attackers got in, how many servers were hit or how much was taken. BTCPay has not said when its investigation will end. The news comes a week after a record hack of the Binance exchange, which involved more than $6 billion in stolen crypto.
If you run your own BTCPay Server, shut it down and keep it off until BTCPay says its investigation is finished.
Fake PayPal emails and texts, some posing as a security report, try to get you to tap a link and type your login. Checking your account directly avoids the trap.
Read more: Got a fake PayPal message? Skip its link and check your account yourselfSecurity firm Flashpoint says criminals are trading in refund tricks, gift card fraud and hacked online stores ahead of the holidays. Shop owners should check their refund steps.
Read more: Scammers are targeting store refunds and gift cards before the holidaysMastercard describes AI tools that could buy things for you, and says trust is the hard part: who gets to spend your money, and under what rules.
Read more: Mastercard outlines how AI assistants could shop and pay for you
