BTCPay Server Warns of Hot Wallet Theft on Outdated Instances

BTCPay Server, an open-source cryptocurrency payment processor, has issued an urgent warning to users following reports of hackers draining “hot wallets” from outdated instances.

The project’s maintainers have identified an attack vector targeting instances running version 2.4.1 or earlier. To mitigate the risk of fund theft, users are strongly urged to install the latest security update, version 2.4.7, immediately.

BTCPay Server founder Nicolas Dorier stated that the attacks did not target public servers, focusing instead on how threat actors were able to gain administrator access to specific instances. The investigation into these unauthorised payments has prompted recommendations for some operators to shut down their servers while investigations continue.

Vulnerability Discovery and Context

The current security push follows the disclosure of a critical vulnerability on 29 October, which was discovered using Anthropic’s Frontier OSS scanner. This discovery led to the release of version 2.4.7 as an emergency update.

While the exact nature of the current exploit has not been clarified, the project noted that clues suggest attackers are leveraging vulnerabilities present in versions older than 2.4.2. This follows a previous incident in August when version 2.4.2 was released to address an actively exploited flaw that exposed LND credential files, which allowed attackers to control Lightning nodes and steal funds.

Remediation Steps for Users

The project has confirmed there are no credible reports of hot wallet drains for users running the most recent 2.4.7 release.

Affected users should take the following actions:

• Standard Installations: Update via Server Settings → Maintenance → Update.
• Docker Installations: Administrators should log in via SSH, run sudo su -, change to the deployment directory (typically cd btcpayserver-docker), and execute ./btcpay-update.sh.

For those currently running version 2.4.1 or older, it is recommended to take the instance offline as soon as possible to prevent further theft. Impacted users are requested to submit all relevant activity logs and details to the project’s security team.