Overview
- BTCPay Server told operators to stop their instances after reports that attackers gained administrator access and swept funds from connected Bitcoin hot wallets.
- The project’s investigation narrowed the likely attack vector to installations running version 2.4.1 (July 23 release) or older and says there are no credible drain reports for the October 29 2.4.7 release.
- BTCPay co-founder Nicolas Dorier said attackers logged in with administrator privileges on affected servers but investigators have not yet determined how that access was obtained.
- Hosting providers including LunaNode have proactively suspended older instances and BTCPay has asked operators to preserve and submit system logs and incident details for the ongoing probe.
- This follows an August flaw that exposed Lightning credentials and an emergency 2.4.7 patch on October 29, so operators are being urged to move funds to cold storage and update software to limit further losses.