BTCPay Server warns of hot wallet thefts targeting outdated instances

The maintainer of BTCPay Server, an open-source cryptocurrency payment processor, has urged users to install the latest version. Hackers have been targeting instances running older versions to drain cryptocurrency hot wallets.

• Attackers targeted instances running BTCPay Server version 2.4.1 or older.
• Users are strongly urged to update to the emergency security release 2.4.7.
• No credible reports of fund drains have been linked to the latest version.

Investigation into the Security Incident

BTCPay founder Nicolas Dorier stated that the attacks did not target public servers. The security investigation focused on determining how threat actors managed to log in as administrators to instances running versions older than 2.4.2. On October 29, the company disclosed a critical vulnerability found via Anthropic's Frontier OSS scanner, prompting the release of version 2.4.7.

Although the exact flaw exploited in recent attacks has not been fully detailed, investigation clues pointed to vulnerabilities predating version 2.4.2. Operators running version 2.4.1 or older were initially advised to take their servers offline to prevent unauthorized transactions and potential financial losses.

Update Guidelines for Administrators

Impacted users are requested to send detailed logs and activity data to security@btcpayserver.org. Standard users can update through Server Settings, Maintenance, and Update menus.

For Docker deployments, administrators must log in via SSH, switch to the deployment directory, and execute the update script. Ensuring timely updates remains critical for self-hosted payment infrastructures to safeguard digital assets against emerging threats.