BTCPay Server Reports No Wallet Drains on Latest Release After Asking Merchants to Go Offline

BTCPay Server asked every merchant running its open-source bitcoin payment software to go offline. The project said on Sunday that hot wallets on some instances were being swept, and its founder later said the attacker had gotten in with admin access. Late Sunday, BTCPay said its investigation had identified the attack vector, which targets instances on version 2.4.1 or older, and urged everyone to keep the software updated.

“We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers,” the project posted on X, asking operators to run its shutdown script “until we complete the investigation.”

Nicolas Dorier, BTCPay Server’s founder, said in a follow-up post about two hours later that the project’s own public servers “were not attacked” and are running version 2.4.7. The reports appear to involve versions before 2.4.2, he wrote, adding that “the attacker managed to log in as admin” on those instances and that the team was “still trying to figure out how.”

Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.

In its latest post, about three and a half hours after Dorier’s, BTCPay said its incident response had found “an attack vector targeting instances running versions 2.4.1” or older. Version 2.4.1 was released on July 23. The project said it has “no credible reports of hot wallet drains for users running the latest 2.4.7 release” and asked anyone affected to email details and logs to its security team.

That post did not describe the attack vector, say whether it accounts for the admin logins Dorier reported, or say whether the request to shut down still stands. None of the three posts put a figure on losses or said how many servers were hit. Beyond the X posts, BTCPay had not published a security advisory on its blog or GitHub as of Monday morning.

The 2.4.2 cutoff Dorier cited is the same line that defined BTCPay’s August security incident. That month, Unchained reported that every BTCPay release before 2.4.2 carried a flaw that let remote attackers grab the credential files for connected Lightning (LND) nodes without logging in. Among those drained were the Lightning nodes of Foundation, which makes hardware wallets, and of the bitcoin publication Citadel21. BTCPay said at the time that its onchain wallets, hot wallets included, were not affected.

This time the funds being taken sit in hot wallets, which keep their private key on the server itself, and the reported entry point is an admin login rather than exposed node credentials. Neither BTCPay nor Dorier has said whether the two incidents are linked.

Related Listen: Bits + Bips: Is Any Cold Wallet Safe? Inside the Coldcard Hack’s Wave Three

{"@context":"http:\/\/schema.org\/","@id":"https:\/\/unchainedcrypto.com\/btcpay-server-reports-no-wallet-drains-on-latest-release-after-asking-merchants-to-go-offline\/#arve-youtube-bpxklomsqm8","@type":"VideoObject","embedURL":"https:\/\/www.youtube-nocookie.com\/embed\/bpxkLOMSQM8?feature=oembed&iv_load_policy=3&modestbranding=1&rel=0&autohide=1&playsinline=1&autoplay=0"}

The post BTCPay Server Reports No Wallet Drains on Latest Release After Asking Merchants to Go Offline appeared first on Unchained.