- BTCPay Server has called for instances to be shut down after reports of thefts from hot wallets.
- Later findings point to installations of version 2.4.1 from July 23 or earlier. The project states that there are no reliable reports from the latest version 2.4.7.
- The number of servers taken over or the amount of losses were not disclosed. How administrator access was gained remains under investigation.
A hot wallet allows you to sign transactions on a device connected to the network. If an attacker gains access to the necessary permissions or secrets, they can siphon off the funds contained therein.
Which installations are reported?
In the November 2 update, the project identified version 2.4.1, released on July 23, and older installations. Project co-founder Nicolas Dorier previously reported that the reports appear to be related to releases prior to 2.4.2. According to sources, the attackers logged in with administrator privileges. It has not been publicly explained how they gained this access.
This does not mean that every installation is safe. Its configuration and whether the server has not been taken over before are also important. Some hosting providers, including LunaNode, proactively disabled older instances.
What about the August gap?
The mere coincidence of the numbers of the older editions is not enough to connect the two incidents. This requires technical arrangements for the project.
What the developers recommend
According to the above-mentioned messages, operators should update their software and leave vulnerable instances disabled until the project’s recommendations are implemented. The initial call to stop the servers was broader than the later indication of versions 2.4.1 and earlier.
An update does not restore stolen funds, nor does it in itself prove that the attacker’s access has been removed from a previously compromised machine.
What does this mean to you
If you are running the store on your own instance, start with the version number that you see in the panel after logging in with an administrator account and the latest security message for the project.
Check the history of transactions and administrative accesses. If you see unauthorized activity, treat it as a suspected server takeover, not just an old version issue.
If you only pay in store, reports apply to sellers’ hot wallets, not customers’ private wallets. If payment details look unusual, confirm with the merchant through another channel.
What is not known yet
The total amount of losses and the number of servers taken over were not disclosed. We are investigating how administrator access was obtained and its possible connection to the August vulnerability.
