BTCPay Server Hot Wallet Hacked, Users Advised to Migrate Funds

BTCPay Server received multiple reports on November 1st indicating that unauthorized funds were stolen from Bitcoin and Litecoin hot wallets on its platform. On November 2nd, the project team confirmed that the attack targeted servers running BTCPay Server version 2.4.1 or earlier. The attackers exploited a vulnerability that was fixed in version 2.4.2 on August 7th, gaining administrative access to the servers through various methods and draining the hot wallet funds. BTCPay Server founder Nicolas Dorier confirmed that only servers running versions prior to 2.4.2 were affected; users running the latest version 2.4.7 have not reported any credible losses. Some affected service providers, including LunaNode, have automatically shut down at-risk older instances. The official recommendation for users still using version 2.4.1 or earlier is to immediately transfer any remaining funds from the old hot wallet to a new wallet created with a fresh mnemonic, and to take the old server offline while retaining relevant logs. Subsequently, install the latest version on a new virtual machine and connect the new wallet, ensuring not to restore the old server entirely to the new machine. Merely updating the software version is insufficient to eliminate risk, as attackers may have gained persistent access on the old server. Funds stored outside the server, such as those in hardware wallets, were not affected by this incident. The vulnerability is related to the one fixed in August of this year, has not been assigned a CVE number, and is not listed in the CISA known exploited vulnerabilities catalog.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.