Hot wallets drained on BTCPay servers left on 2.4.1

BTCPay Server, the self-hosted payment processor used by merchants to accept Bitcoin, says attackers have stolen Bitcoin and Litecoin from hot wallets on servers running version 2.4.1 or earlier. A hot wallet keeps its spending keys on the server itself. The attackers exploited a vulnerability that was fixed in 2.4.2, released on 7 August, using a different method from the one described at the time. The project says it has seen no impact on servers already running 2.4.2 or later when it issued its warning.

The timeline is short. A wallet drain described in incident reports took place at 13:46 on 1 November, and the first email reporting a theft arrived at 20:56. The project asked hosting providers, including LunaNode, to take instances offline as a precaution, warned the community at 22:25 that evening and on 2 November identified 2.4.1 and earlier as the affected versions. It has not established when exploitation began, and it says it wishes it had done more to reach users still on older versions.

The advice goes well beyond updating. Operators who ran 2.4.1 or earlier should sweep any remaining hot-wallet funds to a new wallet created with a new seed on a trusted device, take the old server offline while preserving logs, provision a fresh machine with the latest release and replace every credential the old server could reach, from hosting and SSH to API and Lightning keys. That applies even with no visible theft, because an unchanged balance does not rule out an earlier compromise.

Funds in wallets whose keys are held off the server, including hardware wallets, were not affected, and the project recommends accepting payments that way. It has published the Bitcoin and Litecoin addresses named in incident reports, while cautioning that some activity there predates the thefts, so their balances are not a confirmed total of losses. It closes by citing the rise in automated attacks using AI as a reason to install updates as they are released.