BTCPay Founder Says Theft Reports May Involve Older Versions

Dorier said reports of hot-wallet thefts appear to involve BTCPay Server releases older than version 2.4.2. The update adds a version detail to Sunday's warning, which told operators to take their instances offline.

At 7:28 p.m. ET Sunday (00:28 UTC Monday), Dorier said the project's public servers running version 2.4.7 were not attacked. He said an attacker had logged in as an administrator on affected instances, but the team had not determined how access was obtained.

BTCPay Server's alert came at 5:25 p.m. ET Sunday (22:25 UTC). The project described reports of unauthorized sweeps from hot wallets hosted on its instances and told operators to stop their services with ./btcpay-down.sh until the investigation is complete.

The software lets operators process Bitcoin payments using infrastructure they host themselves. Its hot-wallet setup can keep the wallet seed on a server so it can sign transactions.

The team has not said how many installations were affected or provided a loss figure. Its investigation is continuing.