Image Credit: Shutterstock
- BTCPay Server identified attacks targeting older software versions after merchant wallet thefts.
- The project urges operators to install version 2.4.7 while the investigation continues.
- Developers have not yet published a total loss figure or compromised server count.
BTCPay Server has identified an attack targeting older versions of its software after reports that thieves emptied merchants’ Bitcoin hot wallets.
The project is urging operators to install its latest release, version 2.4.7, as the investigation continues.
Older Versions Targeted After Shutdown Warning
The findings announced on Nov. 2 concern version 2.4.1, released July 23, and earlier versions. On Nov. 1, the team had asked operators to take their servers offline while it investigated unauthorized withdrawals.
Founder Nicolas Dorier said an attacker had logged into affected servers as an administrator. The team was still working out how that access was obtained. In its latest update, the BTCPay team said:
“[…] We have no credible reports of hot wallet drains for users running the latest 2.4.7 release.”
BTCPay has not yet published a loss figure or said how many servers were compromised.
Running BTCPay Puts Operators in Charge of Security
BTCPay directs customer payments into the merchant’s wallet. Businesses can run the open-source software on their own equipment or use a hosting provider.
Enabling a hot wallet adds the power to spend. The server stores the wallet seed and uses it to authorize outgoing Bitcoin transfers, so routine payouts need no separate signing device. An intruder who takes control of that setup may get access to the money too.
Leaving updates for later is a particularly bad bet when the same machine can spend the balance.
BTCPay’s developers can publish fixes and warnings, but operators and hosting providers run the installations. They have to apply updates and carry out emergency shutdowns themselves.
Version 2.4.7 Arrived Before the Theft Warning
The latest release was already available on Oct. 29. It fixed 85 security findings reported through Anthropic’s open-source scanning program, including one rated critical and 13 rated high.
BTCPay also dealt with a wallet-theft incident in August. That flaw exposed credentials for Lightning payment nodes and did not affect BTCPay’s ordinary on-chain hot wallets. The project has not confirmed it as the cause of the latest thefts.
Operators can find their installed version in the page footer when logged in as a server administrator. Supported installations have an update option under Server Settings, then Maintenance.
The team’s advice is to keep hot-wallet balances limited to daily needs and regularly move excess funds to cold storage. BTCPay has asked affected operators to send incident details and logs to [email protected].
