BTCPay Server, an open-source cryptocurrency payment processor used by merchants and organisations to accept crypto payments, has warned users to update to the latest version after reports that attackers stole funds from hot wallets on outdated installations. The warning is particularly relevant for businesses that self-host payment infrastructure or rely on internal IT teams to maintain crypto-related services.

What happened

According to the BTCPay Server maintainer, attackers have been draining hot wallets on instances running older versions of the software. A hot wallet is a cryptocurrency wallet connected to the internet, which makes it practical for payment processing but also more exposed to compromise than offline storage.

The published warning does not mean every BTCPay Server installation has been breached. However, it does indicate a live security risk for organisations that have not kept their instances updated. Businesses using older deployments should treat the issue as a priority until they verify their version status, wallet exposure and server security controls.

Why it matters for European businesses

For most European companies, cryptocurrency payments remain a niche channel rather than a core revenue stream. But for firms that do accept crypto, especially in e-commerce, digital services or international transactions, a compromise can lead to direct financial loss, operational disruption and reputational damage.

This is also a broader reminder about self-hosted financial infrastructure. Open-source tools can offer flexibility and lower platform dependency, but they also shift patching, monitoring and incident response responsibilities onto the business or its technology partners. If updates are delayed, exposed systems may become easy targets.

The incident may also matter to companies beyond crypto-native businesses. Agencies, IT providers and developers that deploy or manage BTCPay Server for clients could face service, trust and contractual risks if customer systems are left on unsupported or outdated versions.

Who may be affected

• E-commerce businesses that accept cryptocurrency through self-hosted BTCPay Server instances
• IT teams and managed service providers responsible for maintaining Linux servers, payment applications and wallet integrations
• Digital agencies and developers that implemented BTCPay Server for merchants or community organisations
• Founders and finance teams at smaller businesses that hold working balances in hot wallets for payment operations
• Organisations using older deployments without a formal patching or vulnerability management process

What companies should consider

• Verify the installed version immediately and compare it with the latest release guidance from the BTCPay Server project.
• Apply updates promptly if the instance is outdated, using tested change-management procedures where possible.
• Review hot wallet exposure. Businesses should avoid keeping more funds online than needed for daily payment operations.
• Check for signs of compromise, including unexpected outgoing transactions, unfamiliar administrative activity and server-level anomalies.
• Strengthen access controls around the server, wallet management interfaces and any connected infrastructure, including admin credentials and remote access.
• Improve backup and recovery planning so teams can rebuild instances and restore service more quickly if a compromise occurs.
• Clarify ownership of updates if the system is managed by an external developer, hosting partner or agency. Businesses should know who is responsible for patching and security monitoring.

For European businesses using crypto payments, the immediate message is practical rather than strategic: if BTCPay Server is part of your payment stack, confirm that it is current, reduce unnecessary hot wallet balances and treat self-hosted payment software as critical financial infrastructure.