The open-source Bitcoin payment processor posted an emergency alert on Nov. 1 after receiving reports that unauthorized attackers were sweeping funds from hot wallets on self-hosted instances.

Operators were told to run ./btcpay-down.sh and keep their servers offline until the team completes its investigation. The alert named no affected versions, gave no loss figure or count of hit instances, and announced no patch.

The shutdown call applies to every instance, regardless of version.

BTCPay's hot wallet feature keeps the seed on the server to sign transactions, so a compromised host can move funds without an external signing device. The warning follows an August incident in which a flaw in versions before 2.4.2 let attackers steal LND credentials and drain Lightning node funds.