Security concerns across the cryptocurrency ecosystem have intensified after two major infrastructure providers disclosed serious wallet-related vulnerabilities and policy changes. Payment processor BTCPay Server and hardware wallet manufacturer Trezor both issued updates following separate incidents that exposed user funds to potential theft.
BTCPay Server, a popular open-source Bitcoin payment processor used by merchants, has instructed operators to switch off their servers amid reports of active hot wallet attacks. According to Decrypt, the project said attacks targeted software versions 2.4.1 and older. The warning arrived only days after developers shipped an emergency patch for a critical flaw. The directive to power down servers reflects the severity of the ongoing exploitation, as hot wallets—by definition connected to the internet—present a broader attack surface than offline storage alternatives. Merchants relying on affected deployments face immediate operational decisions while the project's maintainers work to contain the fallout.
In a separate development underscoring the importance of user-controlled security settings, Trezor announced it has raised its passphrase ceiling to 128 characters. Cointelegraph reported that the hardware wallet maker cited July’s Coldcard attacks as the catalyst for the change. During those incidents, strong passphrases helped shield some users whose wallet recovery information had been compromised. By expanding the maximum length, Trezor is giving customers the option to create longer, more complex passphrases that are harder to brute-force, directly addressing a vector that proved decisive in the Coldcard cases.
Together, the two episodes highlight renewed pressure on both software and hardware layers of the Bitcoin stack. BTCPay Server’s emergency shutdown recommendation signals that hot wallet implementations within self-hosted payment infrastructure remain a persistent target for attackers. Trezor’s revised passphrase policy, meanwhile, illustrates how vendors are recalibrating default and maximum security boundaries in response to real-world breach data rather than theoretical risks.
The timing of the BTCPay alert is particularly notable because it follows so closely on the release of an emergency fix for a critical flaw, suggesting that earlier patches may not have fully neutralized the threat or that new exploitation methods emerged swiftly after deployment. For merchants, the instruction to switch off servers entirely—rather than simply update in place—indicates a level of caution that prioritizes fund safety over transaction uptime.
On the hardware side, the Coldcard attacks demonstrated that even when seed backups or recovery materials fall into the wrong hands, an additional passphrase layer can prevent unauthorized access. Trezor’s move to extend its passphrase limit provides a direct response, though users must still balance complexity against their own backup and recovery practices to avoid lockouts.