The BTCPay Server project posted on X at about 5:26 PM ET on Nov 1: "We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers. If you're running an instance, please shut it down (./btcpay-down.sh) until we complete the investigation." Core contributor r0ckstardev repeated the call ("Not a drill: shut down your BTCPay Server if you have a hot wallet"), and at least one merchant, CoinCards, said it took its BTCPay server down as a precaution.

As of this writing the project has not said how the wallets were reached, which versions or deployments are affected, or how many instances were hit. There is no GitHub security advisory yet; the latest release is v2.4.7 (Oct 29). Treat any cause circulating on social media as unconfirmed.

What to do: if you run BTCPay Server with a hot wallet, take it down now as the project asks, move any funds you can still control to a wallet whose keys never touched the server, and watch the project's official channels for the advisory before bringing it back up. Review server access logs and SSH keys for anything unexpected.