BTCPay Server Urges Immediate Migration After Older-Version Vulnerability Steals Hot Wallet Funds

BTCPay Server advised users of older versions to migrate after a vulnerability was used to steal funds from hot wallets. According to Odaily, the open-source Bitcoin payment processor received multiple reports on November 1 of unauthorized withdrawals from Bitcoin and Litecoin hot wallets, and the project team said on November 2 that the attacks targeted servers running version 2.4.1 or earlier. The vulnerability was fixed in version 2.4.2 on August 7. BTCPay Server founder Nicolas Dorier said servers running versions before 2.4.2, particularly 2.4.1, were affected; there were no credible reports of losses from users running the latest version, 2.4.7. Some service providers, including LunaNode, automatically shut down at-risk older instances. The project advised users on version 2.4.1 or earlier to transfer remaining funds from old hot wallets to new wallets created with fresh recovery phrases, take the old servers offline, and retain relevant logs. Users should then install the latest version on a new virtual machine and connect the new wallets, without restoring the old server wholesale. Updating the software alone may not remove the risk because attackers may have retained access to old servers. Funds held outside the servers, including in hardware wallets, were not affected. The vulnerability is related to one fixed in August, when attackers used LND administrative credentials to control nodes. It has not been assigned a CVE number and is not listed in CISA’s Known Exploited Vulnerabilities catalog.