BTCPay Server Ties Hot Wallet Drains to Versions 2.4.1 and Older

BTCPay Server told merchants on Sunday that attackers swept hot wallets on instances running version 2.4.1 or older, a release from July 23. No loss total or count of hit servers has been published.

The first alert came at 5:25 p.m. ET on X. "We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers," the project posted, and it asked operators to shut their servers down until it finished looking.

What the team found

Founder Nicolas Dorier wrote at 7:28 p.m. ET that the attacker "managed to log in as admin on those instance," and that the team was still working out how. At 11:07 p.m. ET, BTCPay said its investigation found an attack vector aimed at 2.4.1 and older, with "no credible reports of hot wallet drains" on 2.4.7. Some instances run through hosting companies were shut down automatically.

How a hot wallet works

BTCPay is free software that shops run on their own servers to take bitcoin. A hot wallet keeps the key that signs payments on that internet-connected server, so the server can pay out on its own. That is handy. It also means anyone who gets admin control of the server can move the coins.

Why the version matters

Version 2.4.2, out Aug. 7, fixed a critical flaw that was already being exploited, according to its release notes. The August advisory said that bug exposed Lightning node credentials and did not touch on-chain hot wallets. Dorier said the team has "traces that pre 2.4.2 vulnerabilities were used" and promised a fuller blog post. Version 2.4.7, released Oct. 29, fixed 85 more findings, one rated critical, per its GitHub release page.

Dorier told operators who had updated since 2.4.2 there is "no reason to panic," and added: "Don't keep too much in your Hot Wallet." BTCPay asked anyone affected to send logs to security@btcpayserver.org.

In our opinion: Self-hosting puts the keys and the chores in the merchant's hands, and skipped updates are the bill coming due. The open question is the exact way in, which the promised write-up should answer. Watch for a loss estimate and whether the attacker's posted addresses move.