BTCPay Server has urged users to shut down their servers while it investigates reports that attackers drained bitcoin from merchants’ internet-connected hot wallets, CoinDesk reports. The free, open-source tool businesses use to accept bitcoin payments told operators to run ./btcpay-down.sh — and keep it off — until the investigation is complete.
BTCPay Server (Credits: CoinDesk)
What BTCPay Said
“We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers. If you’re running an instance, please shut it down (./btcpay-down.sh) until we complete the investigation,” BTCPay said on X. A wallet “sweep” means the coins were moved out in one go. Because every BTCPay instance is self-hosted, the project had to ask each server owner to shut down individually — it cannot do it for them. BTCPay named no loss amount, gave no count of affected servers and announced no fix; the shutdown call was not limited to one version.
Versions Older Than 2.4.2 Appear Affected
About two hours later, founder Nicolas Dorier gave more detail: the theft reports “appear to involve BTCPay Server releases older than version 2.4.2” — servers that haven’t updated. The attacker logged in as an administrator on the hit servers, though investigators have not determined how access was gained, and Dorier did not confirm that newer versions are safe. The project’s own public servers, running 2.4.7, “were not attacked.”
Affected users have been asked to submit incident details and server logs while the investigation continues.
Also Read: Strangers Are Begging the Binance Hacker for Bitcoin, One ‘Help Me Bro’ at a Time
Source: CoinDesk — read the full story there.
