BTCPay Server urges update after hot wallets drained on older instances
BTCPay Server urged administrators on November 2 to update after hackers drained hot wallets on instances running older versions of its self-hosted cryptocurrency payment processor. The project said its incident response team identified an attack vector against version 2.4.1 and earlier, and recommended updating to version 2.4.7.
The attacks affected systems that businesses use to process Bitcoin, Litecoin and other digital-asset payments directly into their own wallets. BTCPay Server said it has no credible reports of hot-wallet drains from users running the latest 2.4.7 release, but it continues to receive incident reports.
Founder Nicolas Dorier said the attacks did not target public servers. The investigation is examining how the attacker logged in as an administrator on instances running versions older than 2.4.2. The project had disclosed a critical vulnerability on October 29 after it was found by Anthropic’s Frontier OSS scanner, and released version 2.4.7 as an emergency security update.
BTCPay Server began receiving theft reports the previous evening in UTC and asked VPS hosting providers to take affected instances offline as a precaution. Administrators running version 2.4.1 or earlier should take the instance offline as soon as possible before updating.
Administrators can install version 2.4.7 through Server Settings, Maintenance and Update. For Docker deployments, the project says to update over SSH from the btcpayserver-docker deployment directory by running its btcpay-update.sh script. Users who lost funds can send incident details to [email protected] and report the losses to local authorities.