BTCPay Server warns hot wallets on instances are being swept by unauthorized attackers
The official BTCPay Server account warned operators that hot wallets on some instances were being swept and asked them to shut instances down until an investigation completes.
Evidence
🚨 We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers. If you're running an instance, please shut it down (./btcpay-down.sh) until we complete the investigation.
Why this was filed here (confidence 80%)
- "reports of hot wallets on BTCPay Servers being swept by unauthorized attackers"
- Official account; 889K impressions
- taxonomy 2026-10-16.1
