Hackers have drained approximately $1.63 million in Bitcoin and Litecoin from hot wallets attached to outdated BTCPay Server installations, the open-source cryptocurrency payment platform said. The thefts affected self-hosted servers running version 2.4.1 or earlier, with blockchain analysis linking 18.38 BTC and 3,405 LTC to the campaign across 682 transactions between October 30 and November 2. Bitquery’s investigation estimated the transfers at $1,628,450. [3]
BTCPay Server said attackers used a different method to exploit a vulnerability fixed in version 2.4.2, released on August 7. The project’s official incident notice identifies the affected release range but does not assign a CVE identifier or publish a CVSS score for the flaw. It also said the attackers logged in as administrators on compromised instances before sweeping funds from connected hot wallets. [17]
The August release was marked by the project as an urgent security update for a critical vulnerability that was already being exploited. The BTCPay Server 2.4.2 release notice instructed operators to update as quickly as possible. The project later issued version 2.4.7, released October 29, after disclosing another critical issue; it has not publicly attributed the attacks to a named group, and no public proof-of-concept or CISA Known Exploited Vulnerabilities listing for this incident has been identified. [22]
BTCPay Server initially urged operators to take vulnerable instances offline while it investigated. It now recommends that anyone who ran version 2.4.1 or earlier treat the server and its wallet credentials as compromised, even if no theft is visible. Operators should move remaining funds to a newly generated wallet with a fresh seed, rebuild the service on a clean server, rotate exposed passwords and access keys, and update to the latest release through the administrative maintenance interface.
The full number of compromised servers and the final loss remain unknown because blockchain records identify wallet activity rather than individual installations. BTCPay said it had no credible reports of comparable hot-wallet drains from instances already running version 2.4.7, but operators should not infer that an upgraded, previously compromised server is clean without rebuilding it. Independent coverage likewise reported that the affected users were those who had not installed the August fix. BleepingComputer’s report carries the project’s update guidance. [16]
References
- BTCPay Server Hack: $1.6M Swept From Merchant Hot …
- Releases · btcpayserver/btcpayserver
- cryptocurrency — Latest News, Reports & Analysis | The Hacker News
- NVD Dashboard
