BTCPay Server hot wallets drained in active attack, users told to shut down

The active exploitation of BTCPay Server hot wallets is a live operational risk for merchants and self-hosted node operators, not a theoretical vulnerability. The fact that drains are ongoing and the cause is undisclosed makes containment—shutting down instances—the only concrete guidance, which underscores how little is known about the attack vector. Whether the Oct. 29 emergency release addressed the exploited flaw, and how many operators ran unpatched instances, is the open question worth watching.