BTCPay Server Attacks Drain Hot Wallets; $1.63M Traced to Linked Addresses

Attackers accessed unpatched BTCPay Server installations and emptied their hot wallets; about $1.63 million in Bitcoin (BTC) and Litecoin (LTC) was traced to addresses linked to the incidents.

BTCPay Server said Nov. 2 that the affected versions were 2.4.1 and earlier. A fix shipped in version 2.4.2 on Aug. 7, and the project had seen no impact on installations running that release or newer when it issued its warning.

From Oct. 30 through the morning of Nov. 2, 682 wallet sweeps sent 18.38 BTC and 3,405 LTC to two incident-linked addresses. The $1.63 million estimate reflects funds reaching those addresses, not a confirmed total loss, and excludes other addresses and assets, including Lightning funds.

After BTCPay’s Nov. 1 warning at 5:25 p.m. ET (22:25 UTC) to take affected instances offline, a further 267 sweeps totaling about $150,000 occurred.

Operators who ran version 2.4.1 or earlier were told to move to a new server with a fresh wallet and seed, even if they had already updated. BTCPay urged users to install version 2.4.7, replace exposed credentials and preserve logs and transaction records.

The same vulnerability was used in August to target LND, a Lightning Network implementation; BTCPay said then that on-chain wallets were not affected.