BTCPay Server Urges Legacy Users to Replace Wallets After Theft Reports

BTCPay Server urged users of older versions to replace their hot wallets after reports of stolen funds from Bitcoin and Litecoin wallets put on servers running the payment software.

The project received multiple reports on Nov. 1. In an investigation update on Nov. 2, BTCPay Server said the attacks targeted servers running version 2.4.1 or earlier. Attackers used different methods to gain administrator access and empty hot wallets, the investigation found.

The vulnerability was fixed in version 2.4.2 on Aug. 7. BTCPay Server founder Nicolas Dorier said the affected versions were those released before 2.4.2, especially version 2.4.1. The project has received no credible reports of losses involving users on the latest version, 2.4.7.

Users still on version 2.4.1 or earlier should move remaining funds to a new wallet created with a fresh recovery phrase, take the old server offline and preserve its logs. The project recommends installing the latest version on a new virtual machine and connecting the new wallet; simply updating the old server may leave attackers with persistent access. Funds held outside the server, including in hardware wallets, were not affected by the incident.