BTCPay Server finds attack vector, reports no wallet drains on latest release

BTCPay Server, a self-hosted Bitcoin payment processor, asked merchants to go offline after an attacker logged in as admin on instances running versions before 2.4.2. Founder Nicolas Dorier said the project's investigation has now pinned down the attack vector, and no wallet drains were reported on the latest release. Traders holding BTC in self-custody payment setups should verify their BTCPay version, though the incident appears contained rather than systemic.