Outdated BTCPay Server Installs Drained of Crypto in Thefts Worth About $1.63m

Attackers have stolen cryptocurrency from hot wallets on outdated BTCPay Server instances, an open-source payment platform. In an incident update on November 2, BTCPay Server said the thefts hit servers running version 2.4.1 or earlier. The attackers used a different method to exploit a vulnerability that was fixed in version 2.4.2, released on August 7. The project had seen no impact on servers running 2.4.2 or later when it issued its warning.

Blockchain intelligence company Bitquery traced 18.38 Bitcoin and 3405 Litecoin, about $1.63m, to two addresses named by BTCPay Server. The funds moved in 682 sweeps between October 30 and the morning of November 2. Bitquery said the thief signed in to the servers as an administrator and swept their hot wallets. The figure is a floor, since it excludes other addresses and coins, including Lightning funds. BTCPay Server also noted that some activity at the two addresses appears to predate the reported thefts, so the balances should not be treated as confirmed losses. The project has not published a loss total.

BTCPay Server urged operators of version 2.4.1 or earlier to move to a fresh server with a new wallet and seed, even if they have since updated, warning that "updating alone cannot remove access an attacker may already have gained." Wallets whose spending keys are held off the server, including hardware wallets, were unaffected. Operators should keep only operational funds on the server, preserve logs and transaction records, replace exposed credentials, and avoid restoring the old server onto a new one.