✓ Verified by 3+ outlets BTC
BTCPay Server tells merchants to shut down after attackers drain hot wallets on older versions
Summary
BTCPay Server, the open-source bitcoin payment software, told operators to shut down their servers on Sunday after reports that attackers were sweeping funds from hot wallets, CoinDesk, Cointelegraph and Decrypt reported.
The project later said it had identified an attack vector targeting instances running version 2.4.1, released July 23, or older, and that it had no credible reports of drains among users on the latest 2.4.7 release, Cointelegraph and Decrypt reported.
Founder Nicolas Dorier said the reports appeared to involve versions older than 2.4.2 and that the attacker had logged in with administrator access, according to Decrypt.
BTCPay has not said how many servers were affected or how much bitcoin was taken, and CoinDesk reported it has not announced a fix; it is asking affected users to send details and logs to its security team.
Key facts
- Some hosting providers, including LunaNode, shut down BTCPay instances automatically to stop older versions from being exploited, the project said.
- BTCPay released version 2.4.7 on Thursday as an emergency update fixing one critical and several medium-severity vulnerabilities; it has not said whether the attacks used any of those flaws.
- Because BTCPay is self-hosted, there is no central operator that can switch instances off; hot wallets keep the wallet's seed on an internet-connected server, a feature BTCPay's documentation labels "DANGER."
- The reports come less than three months after an August attack that exploited a vulnerability to obtain Lightning Network Daemon credentials; it is unclear whether the two are connected.
- The project has not given a loss figure or announced a fix, CoinDesk reported.
Related stories
- Bitcoin drops below $72,000 as spot ETFs bleed $1.44 billion in five days and BlackRock's IBIT loses $2 billion in nine
- Bitcoin treasury firm Nakamoto owes Kraken $165 million, more than its market value, as Q3 operating revenue turns negative
- Binance sets aside $6.34 billion to cover record hack as TRM and Chainalysis tie it to North Korea's TraderTraitor