Old Vulnerability Leads to Hot Wallet Fund Theft, BTCPay Server Advises Users to Migrate Immediately

Open-source Bitcoin payment processing tool BTCPay Server received multiple reports on November 1 alleging unauthorized theft of funds from Bitcoin and Litecoin hot wallets on its platform. On November 2, the project team released an investigation update confirming that the attack targeted servers running BTCPay Server version 2.4.1 or earlier. Attackers exploited a vulnerability that had been fixed in version 2.4.2 on August 7, using various methods to gain server administrator privileges and drain hot wallet funds. BTCPay Server founder Nicolas Dorier confirmed that only servers running versions prior to 2.4.2, particularly version 2.4.1, were affected; no credible loss reports have emerged from users running the latest version 2.4.7. Some affected service providers, including LunaNode, have automatically shut down vulnerable legacy instances. The official recommendation is for users still on 2.4.1 or earlier to immediately transfer any remaining funds from old hot wallets to new wallets created with a fresh mnemonic phrase, take the old servers offline and preserve relevant logs, then install the latest version on a brand-new virtual machine and connect the new wallet. Under no circumstances should the old server be restored in its entirety to a new machine. Updating the software version alone is insufficient to eliminate the risk, as attackers may have already established persistent access on the old servers. Funds stored outside the server, such as those in hardware wallets, were not affected by this incident. The vulnerability is related to one fixed in August of this year, when attackers manipulated nodes by obtaining LND administrative credentials. As of now, the vulnerability has not been assigned a CVE number and is not listed in CISA's Known Exploited Vulnerabilities catalog.