BTCPay Server’s 2.4.7 Release Lists 85 Security Findings

BTCPay Server’s version 2.4.7 release lists 85 security findings across four severity levels, and the project recommends that operators upgrade, particularly on servers shared by multiple merchants.

The release notes list one critical finding, 13 high, 52 medium and 19 low. The project published the update Oct. 29.

A separate update on Nov. 2 addressed hot-wallet theft reports from Nov. 1. BTCPay Server identified versions 2.4.1 and earlier as targets and said attackers used a different method involving a vulnerability fixed in version 2.4.2, released Aug. 7. The project did not connect those thefts to the findings listed in version 2.4.7.

Operators who ran version 2.4.1 or earlier are advised to move to a fresh server with a new wallet, even if they later updated. Wallets whose spending keys were kept off the server, including hardware wallets, were unaffected by the reported thefts. The hot-wallet reports were covered in an earlier article.