A post by @lookonchain on X.

Attackers are reportedly draining hot wallets on BTCPay Server instances, according to an alert from on-chain analyst Lookonchain, which urged anyone running the self-hosted bitcoin payment processor to shut down their servers immediately. BTCPay Server is widely used by merchants and businesses as an open-source, self-custodial alternative to third-party payment processors, meaning compromised instances put merchant bitcoin holdings and customer payment flows at direct risk. The alert did not specify the attack vector, the number of affected instances, or total funds lost, and BTCPay Server's official channels had not yet confirmed the incident at the time of the tweet. Merchants running exposed instances face potential loss of hot-wallet funds until the vulnerability is identified and patched. Watch for official confirmation from the BTCPay Server team, disclosure of the exploit method, and guidance on when it is safe to bring instances back online.