Lifestyle
BTCPay Urges Merchants to Shut Down Servers: Hot Wallets Reportedly Drained, Project Says Attack Targeted Version 2.4.1 and Older
Per Decrypt, bitcoin payment software BTCPay Server urged self-hosting merchants to switch off their servers after reports of drained hot wallets. The project says the attack targeted version 2.4.1 or older; the scale of impact is unannounced.
About 5 min read
What happened
Per Decrypt, BTCPay Server is a free, open-source tool businesses use to accept bitcoin payments. On Sunday (Nov. 1), the project urged operators, the people running the software on their own servers, to shut those servers down because of reports that attackers were sweeping (moving out funds from) hot wallets connected to them.
As quoted by Decrypt, BTCPay posted at 5:25 p.m. Eastern Time: "We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers." The project asked operators to shut down the BTCPay Servers they run (./btcpay-down.sh) until the investigation is complete.
Per Decrypt, about two hours later founder Nicolas Dorier said the reports appeared to involve older versions prior to 2.4.2, and that the attacker had logged in to the affected servers with administrator privileges.
The project's current account and what is unknown
Per Decrypt, the project later said its investigation had identified an attack path targeting version 2.4.1 (released July 23) or older, and that there were "no credible reports" of hot wallets being drained for users on the latest version, 2.4.7. It also urged everyone to keep their software updated and asked affected users to send details and logs (system activity records) to its security team.
Per Decrypt, BTCPay released 2.4.7 on Thursday as an emergency update fixing one critical and several medium-severity vulnerabilities. The project said these flaws came to its attention through Anthropic's open-source software scanner; BTCPay has not said whether this attack exploited them.
Per Decrypt, BTCPay has not said how many servers were affected or how much bitcoin was taken.
| Item | What Decrypt reported |
|---|---|
| Affected versions | The project says the attack targeted version 2.4.1 or older |
| Latest version | The project says there are no credible reports of 2.4.7 users being drained |
| Attacker behavior | Dorier says the attacker logged in to affected servers with administrator privileges |
| Scale of victims | BTCPay has not disclosed server counts or amounts lost |
| Hosting providers | The project says some hosts, including LunaNode, automatically shut down BTCPay servers to prevent old versions from being exploited |
Why hot wallets are especially sensitive
Per Decrypt, BTCPay is self-hosted software that each merchant runs on its own server. No central operator can switch these servers off, so each operator or its hosting provider has to act.
Per Decrypt, merchants can choose to use a hot wallet, storing the wallet seed (the secret data that lets the software authorize transactions for the wallet) on an internet-connected server so transactions are signed, that is, authorized, automatically. BTCPay's own documentation labels this feature "DANGER" and warns that it "comes with security implications."
Per Decrypt, this is not the first security alarm for the project this year. In August, BTCPay warned that all versions before 2.4.2 had a critical vulnerability being actively exploited, and told users to update or shut down their servers. Supporters of the project later funded a bounty of 10% of returned stolen funds, capped at 3 BTC.
Who is affected
Per Decrypt, the targets were hot wallets connected to operators' servers; the report does not mention funds of ordinary payers being affected.
Frequently asked questions
Which BTCPay versions were attacked?
Per Decrypt, the project says the attack path targeted version 2.4.1 (released July 23) or older. Dorier earlier said the reports appeared to involve versions before 2.4.2.
Is the latest version, 2.4.7, safe?
As quoted by Decrypt, the project says there are no credible reports of hot wallets being drained for users on 2.4.7. That is the project's current statement and should not be taken as a guarantee.
How large are the losses?
Per Decrypt, BTCPay has not said how many servers were affected or how much bitcoin was taken.
Did the attack exploit the vulnerabilities patched on Thursday?
Per Decrypt, BTCPay has not said whether the attack exploited the vulnerabilities fixed in 2.4.7.
What has the project asked operators to do?
Per Decrypt, the project first asked operators to shut down their servers until the investigation was complete, then urged everyone to keep software updated and asked affected users to send details and logs to its security team.
Browse the latest news in this topic
Lifestyle
Proton Users Cancel Subscriptions After CEO Reportedly Called Security Caution 'Loser Thinking'
Per Decrypt, Proton faces user backlash over claims it pressured staff to code with AI and downplayed security testing; the company has canceled AI staff re-interviews and published an engineering manifesto defending its approach.
Lifestyle
Nvidia, Nike and 10 More Companies Object: List Blocking OKX-ICE Tokenized Stock Platform Reaches 50
Per Decrypt, OKXICE TSV's Oct. 30 update added 12 objecting companies, including Nvidia, Costco and Nike, for a total of 50. Under SEC rules, their shares cannot trade on the platform as third-party tokenized versions, showing that listing depends on issuer consent.
Lifestyle
Brazil's Largest Exchange Mercado Bitcoin Halts Withdrawals After Security Incident; Tether Freezes Over 4.5 Million USDT
Per Decrypt, Brazil's largest crypto exchange Mercado Bitcoin suspended deposits and withdrawals on Nov. 2 after a security incident. Users cannot deposit or withdraw for now, with no restart date. Hypernative flagged over $40 million in suspicious transfers; the exchange has not confirmed this.
Lifestyle
Decrypt: Binance Hacked for About $6.4 Billion; Tether and Circle Freeze Over $2.3 Billion in Stolen Stablecoins
Decrypt reports attackers withdrew about $6.4 billion from crypto exchange Binance, which it calls the largest hack in crypto history. Binance pledged to cover all losses with company funds and an emergency reserve; Tether and Circle froze over $2.3 billion of stolen stablecoins.