Hackers have stolen roughly $1.63 million in Bitcoin and Litecoin from merchants running outdated versions of BTCPay Server, the open-source payment processor. Blockchain analysis firm Bitquery traced 18.38 Bitcoin and 3,405 Litecoin to two addresses linked to the thefts, moved in 682 separate sweeps between October 30 and the morning of November 2.
The Vulnerability and the Fix
The attacks targeted servers running version 2.4.1 or earlier, exploiting a vulnerability that had been patched in version 2.4.2 released on August 7. BTCPay Server said the attackers used a different exploitation method than the one identified during an earlier incident in August, which had allowed thieves to steal Lightning Network credentials. The project confirmed that servers already running version 2.4.2 or later when the warning was issued showed no impact from these latest attacks.
In plain terms, the flaw let intruders sign in to the server’s administrative dashboard as if they were the owner. Once inside, they could empty the hot wallet — the internet-connected wallet the software uses to automate payments. Think of it like a shopkeeper leaving the safe key under the doormat; the patch changed the locks, but anyone who copied the key before August could still walk in.
Timeline of the Attack
BTCPay Server first received reports of unauthorized withdrawals on November 1. A wallet drain was reported at 13:46 UTC, followed by an email to the security team at 20:56 UTC. By 22:25 UTC, the project had publicly warned operators to shut down their instances and contacted hosting providers, including LunaNode, requesting precautionary shutdowns.
Bitquery said 87% of the traced funds moved in a single wave on the afternoon and evening of November 1. Notably, the firm counted 267 further sweeps worth about $150,000 after BTCPay Server told operators to shut down their instances that night. The practical upshot: the warning came too late for some operators who had not yet acted.
What Operators Need to Do Now
BTCPay Server has urged anyone running version 2.4.1 or earlier to move to a fresh server with a new wallet and seed phrase, even if they have since updated to the latest version 2.4.7. The project warned that “updating alone cannot remove access an attacker may already have gained.”
Here’s what it means for a typical merchant: if your server was ever running a vulnerable version, you must treat the entire machine as compromised. That means preserving logs, replacing all exposed credentials, and avoiding restoring the old server onto new hardware. Wallets whose spending keys are held off the server — such as hardware wallets — were not affected by this attack.
Unanswered Questions
The project has not published a total loss figure, and Bitquery cautioned that its $1.63 million figure is a floor. The analysis covered only two addresses and excluded Lightning funds and other coins. BTCPay Server also noted that some activity at the two identified addresses appears to predate the reported thefts, making the exact loss amount difficult to confirm.
Founder Nicolas Dorier confirmed that intruders logged in as administrators, but the project said it is still determining how they obtained those credentials. As of November 2, BTCPay Server had received no credible reports of hot wallet drains from users running the latest 2.4.7 release, though it stopped short of declaring every updated installation safe.
Sources
- Hackers Exploit BTCPay Server Flaw to Steal Cryptocurrency
- Hackers Exploit BTCPay Server Flaw to Steal Bitcoin and Litecoin From Hot Wallets
- BTCPay Server Warns of Bitcoin Hot Wallet Drains, Identifies Security Flaw in Older Versions
- BTCPay Server Tells Operators To Shut Down After Bitcoin Hot Wallet Drains: 10 outlets compared | NewsCord
- Hackers Drain Bitcoin Hot Wallets on BTCPay Servers, Users Urged to Shut Down Immediately
Photo: Jakub Żerdzicki / Unsplash (Unsplash License)
