BTCPay Urges Server Rebuild After $1.63 Million Theft Estimate

BTCPay Server urged anyone who had run version 2.4.1 or earlier, even if they later updated, to move remaining hot-wallet funds into a new wallet and rebuild on a fresh server. An on-chain estimate valued incident-linked transfers at $1.63 million.

The estimate counted 682 sweeps, or transactions, including 18.38 Bitcoin (BTC) and 3,405 Litecoin (LTC). It valued the transfers at $1,628,450 using hourly prices from the morning of Nov. 2. The Bitcoin count ran through 12:42 a.m. ET (05:42 UTC), while the Litecoin count ran through 1 a.m. ET (06:00 UTC).

BTCPay has yet to establish the total loss or how many servers were compromised. It noted that some activity at the identified destination addresses may predate the reported thefts, so the estimate is not a confirmed loss figure.

The project said the attacks used a different method to exploit a vulnerability fixed in version 2.4.2 on Aug. 7. Its Nov. 1 warning said it had seen no impact on servers already running version 2.4.2 or later. “Updating alone cannot remove access an attacker may already have gained,” BTCPay said.

Recovery steps include generating a wallet with a new seed on a trusted device, taking the old server offline, preserving logs, installing on a fresh virtual machine without restoring the prior system and replacing potentially exposed credentials. Hot wallets keep spending keys on the server; BTCPay said wallets with keys held off-server, including hardware wallets, were unaffected.