Is Your BTCPay Server Safe? What the Hot Wallet Drain Investigation Shows
Attackers gained admin entry to outdated BTCPay Server cases and swept their sizzling wallets, and traces level to flaws that predate an August patch.
The injury falls on operators who by no means up to date, and the crew has but to reveal the complete losses. BTCPay Server is a free, open-source cost processor that retailers host themselves to just accept Bitcoin. In a sizzling pockets setup, the server shops the non-public keys itself, which lets the software program ship funds with out the operator signing every transaction. As a outcome, anybody with admin entry to such a server can transfer its cash.
Which Versions Did the Attackers Target?
The BTCPay Server crew first raised the alarm late on Nov. 1. It requested each operator to close down their occasion till the investigation ends.
A follow-up then narrowed the scope. The assault vector targets model 2.4.1, launched on July 23, 2026, and something older. Meanwhile, the crew says it has no credible stories of drains on the present 2.4.7 launch.
Founder Nicolas Dorier said the attacker logged in as an admin on the affected servers, although the crew has not but labored out how. So far, the investigation has discovered traces of vulnerabilities that predate model 2.4.2.
The breach marks no less than the second time in three months that attackers have stolen funds from BTCPay Server cases working variations older than 2.4.2. That launch patched a critical flaw in August, which let distant attackers seize Lightning node credentials and drain linked wallets.
Even then, the bug was already under active exploitation.
Is a BTCPay Server Hot Wallet Worth the Risk?
Hosting suppliers moved rapidly as nicely. LunaNode and others might have shut down buyer cases routinely to dam assaults on older variations, the crew says.
Dorier runs model 2.4.7 with a sizzling pockets himself. Still, the founder warned in opposition to preserving massive sums on any server.
Don’t put greater than you’re able to lose in sizzling pockets. We can’t assure it gained’t occur once more.
Nicolas Dorier, X
The incident suits a broader sample throughout self-hosted Bitcoin infrastructure. Core Lightning lately warned that attackers target unpatched nodes. In each instances, the repair existed earlier than the theft, so the weakest level was an operator who put in a BTCPay Server occasion as soon as and by no means up to date it.
The put up Is Your BTCPay Server Safe? What the Hot Wallet Drain Investigation Shows appeared first on BeInCrypto.
