Hackers drain BTCPay hot wallets on servers left unpatched since July

Updated 2 November, 04:52 UTC. BTCPay Server says the attacks targeted version 2.4.1 or older, with no credible reports on 2.4.7, and hosting providers shut older servers down.

BTCPay Server, the open-source software merchants run on their own servers to accept bitcoin, says the attacks that emptied hot wallets on Sunday night targeted instances running version 2.4.1 or older. That release dates from July 23. "We have no credible reports of hot wallet drains for users running the latest 2.4.7 release," the project said early on Monday, about six hours after it told everyone running it to shut down while it investigated.

Lead developer Nicolas Dorier said the project had traces that vulnerabilities fixed in 2.4.2 were used, and that on the affected servers the attacker had logged in as admin. After sorting through the reports, he said that anyone on a version above 2.4.2 was not affected. He also published the attacker's bitcoin address. A blog post with more detail is promised.

Some hosting providers acted on the first warning. BTCPay Server said instances run through a host may have been shut down automatically to keep older versions from being exploited, and thanked LunaNode and others. For servers that were hit, Dorier's advice goes further than moving the funds: "Not only the seed, they should consider the server cooked." The project asks anyone affected to send details and logs to security@btcpayserver.org.

The August incident

This is the second time in three months that BTCPay Server users have lost funds. In August the project said a vulnerability let an unauthenticated attacker obtain credential files for LND, the Lightning node software many instances run alongside it, and that funds were stolen from those nodes. Its advisory at the time said that "BTCPay Server's on-chain wallets, including hot wallets, are not affected." The reports now concern those hot wallets.

Since August the project has shipped a run of security releases. The most recent, version 2.4.7 on October 29, fixes 85 security findings, one rated critical and 13 high, reported through Anthropic's open-source scanning program. The affected versions are the ones that still lack the August fix.