BTCPay Server investigates hot wallet drains targeting older software versions
BTCPay Server urged merchants to take their instances offline following reports of unauthorized attackers draining hot wallets, later identifying an attack vector affecting version 2.4.1 or older.
Open-source bitcoin payment processor BTCPay Server warned users on Sunday to shut down their instances after receiving reports of unauthorized attackers sweeping hot wallets across multiple servers. In an initial statement posted to X, the project urged operators to execute its shutdown script, ./btcpay-down.sh, while an active investigation into the drains was underway.[4][5][2]
BTCPay Server founder Nicolas Dorier stated shortly after that the project's own public servers were running version 2.4.7 and were not attacked. Dorier noted that the incidents appeared to involve versions older than 2.4.2, explaining that an attacker had managed to log in with administrator privileges on the affected instances while developers worked to understand how access was obtained.[4][2]
In a subsequent update, BTCPay Server announced that its incident response team identified an attack vector targeting instances running version 2.4.1 or older, which originally shipped in July. The team stated there were no credible reports of wallet drains on the latest 2.4.7 release and asked impacted operators to submit logs and incident details to its security team. BTCPay Server had not disclosed total financial losses or published an official advisory on GitHub or its blog as of Monday morning.[1][3][4]
Key facts
- BTCPay Server warned operators to shut down instances via ./btcpay-down.sh following reports of unauthorized attackers sweeping hot wallets.
- The project's incident response identified an attack vector targeting instances running version 2.4.1 or older.
- BTCPay Server reported no credible accounts of hot wallet drains on the latest release, version 2.4.7.
- Founder Nicolas Dorier said the attacker gained administrator login access on affected instances and that BTCPay Server's public servers were not compromised.
- BTCPay Server had not released loss figures, server counts, or formal blog or GitHub advisories as of Monday morning.
Sources · 5 sources
- DE
Decrypt@DecryptMediaPost on X ·
BTCPay Server Says Attack Targeted Older Versions After Hot Wallet Sweep Reports. The open-source Bitcoin payment processor said the attack vector it identified targeted instances running version 2.4.1 or older, adding it has no credible reports of hot wallet drains on the latest 2.4.7 release.
Open source - CO
CoindeskArticle ·
BTCPay, a bitcoin payment tool, tells users to switch off their servers after reports of drained wallets The open-source project says it is still investigating and hasn't given a loss figure or announced a fix. Its founder said the reports appear to involve versions older than 2.4.2.
Open source - DE
DecryptArticle ·
BTCPay Tells Merchants to Switch Off Servers Amid Hot Wallet Attack Reports The Bitcoin payment software says attacks targeted versions 2.4.1 and older, days after it shipped an emergency fix for a critical flaw.
Open source - UN
UnchainedArticle ·
BTCPay Server Reports No Wallet Drains on Latest Release After Asking Merchants to Go Offline BTCPay Server asked every merchant running its open-source bitcoin payment software to go offline. The project said on Sunday that hot wallets on some instances were being swept, and its founder later said the attacker had gotten in with admin access . Late Sunday, BTCPay said its investigation had identified the attack vector, which targets instances on version 2.4.1 or older , and urged everyone to keep the software updated. “We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers,” the project posted on X , asking operators to run its shutdown script “until we complete the investigation.” Nicolas Dorier , BTCPay Server’s founder, said in a follow-up post about two hours later that the project’s own public servers “were not attacked” and are running version 2.4.7 . The reports appear to involve versions before 2.4.2 , he wrote, adding that “the attacker managed to log in as admin” on those instances and that the team was “still trying to figure out how.” Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter . What BTCPay Said Next In its latest post , about three and a half hours after Dorier’s, BTCPay said its incident response had found “an attack vector targeting instances running versions 2.4.1” or older. Version 2.4.1 was released on July 23. The project said it has “no credible reports of hot wallet drains for users running the latest 2.4.7 release” and asked anyone affected to email details and logs to its security team. That post did not describe the attack vector, say whether it accounts for the admin logins Dorier reported, or say whether the request to shut down still stands. None of the three posts put a figure on losses or said how many servers were hit. Beyond the X posts, BTCPay had not published a security advisory on its blog or GitHub as of Monday morning. A Different Target Than August The 2.4.2 cutoff Dorier cited is the same line that defined BTCPay’s August security incident . That month, Unchained reported that every BTCPay release before 2.4.2 carried a flaw that let remote attackers grab the credential files for connected Lightning (LND) nodes without logging in. Among those drained were the Lightning nodes of Foundation , which makes hardware wallets, and of the bitcoin publication Citadel21 . BTCPay said at the time that its onchain wallets, hot wallets included, were not affected. This time the funds being taken sit in hot wallets, which keep their private key on the server itself, and the reported entry point is an admin login rather than exposed node credentials. Neither BTCPay nor Dorier has said whether the two incidents are linked. Related Listen: Bits + Bips: Is Any Cold Wallet Safe? Inside the Coldcard Hack’s Wave Three The post BTCPay Server Reports No Wallet Drains on Latest Release After Asking Merchants to Go Offline appeared first on Unchained .
Open source - TB
The Block@TheBlockCoPost on X ·
THE BLOCK: BTCPay Server, the open-source bitcoin payment processor, said it is receiving reports of hot wallets on its servers being swept by unauthorized attackers. The team urged anyone running an instance to shut it down until it completes its investigation. https://t.co/S7WaC0VP29
Open source