BTCPay Server says the Bitcoin and Litecoin thefts reported from hot wallets on 1 November hit servers running version 2.4.1 or earlier, and it is telling those operators to move to a fresh server with a new wallet.
The open-source payment processor published its account on 2 November. According to BTCPay Server, the attackers used a different method to exploit the vulnerability fixed in 2.4.2, which shipped on 7 August. Its timeline lists a wallet drain at 13:46 UTC on 1 November, the first theft report by email at 20:56 UTC and a public warning on X at 22:25 UTC asking operators to shut their servers down. The project says it contacted VPS hosts, including LunaNode, which took instances offline as a precaution.
The guidance goes past patching. For any server on 2.4.1 or earlier, BTCPay Server recommends sweeping remaining hot-wallet funds into a new wallet created on a trusted device with a new seed, taking the old server offline, preserving logs, provisioning a fresh virtual machine and replacing hosting, SSH, API and Lightning credentials the old server could reach. It says that “updating alone cannot remove access an attacker may already have gained.” Wallets whose spending keys sit off the server, including hardware wallets, were unaffected by these thefts.
The project also wrote that it wished it had “done more to reach users still running older versions,” three months after its August advisory for 2.4.2. In our reading, the lesson for any team running self-hosted software that holds keys is that a fix shipped months ago does not count until every instance is on it, and a server that sat unpatched through active exploitation should be rebuilt. Our opinion on starting the patch clock on release day argues the same point, and our brief on the Bitget hot wallet breach covers an earlier hot wallet loss.
Source: BTCPay Server, Security Incident Affecting BTCPay Server 2.4.1 and Earlier
