BTCPay Server is urging operators of installations through version 2.4.1 to migrate after attackers used multiple methods to gain administrator access and drain hot wallets holding Bitcoin (BTC) and Litecoin (LTC).
The project logged several theft reports Nov. 1; its investigation update the next day set the affected range at version 2.4.1 and earlier. Investigators found that intruders used more than one approach to gain administrator-level control before emptying hot wallets. BTCPay Server said the vulnerability fix shipped in release 2.4.2 on Aug. 7. It reported no credible hot-wallet loss reports involving version 2.4.7.
The Nov. 2 update gave no combined loss total, and EconoTimes previously reported that the scale of the thefts remained undisclosed. BTCPay Server said funds held outside the server, including funds in hardware wallets, were unaffected.
Operators still using affected releases should create a replacement wallet with a fresh recovery phrase and transfer any remaining hot-wallet funds. The project advised taking the old server offline and preserving its logs, then installing the latest release on a new virtual machine and connecting the replacement wallet. It said an update to the old server may not revoke access attackers have already gained. The guidance expands on BTCPay Server's earlier identification of an attack vector in older installations.
