BTCPay Server vulnerability: about $1.63M traced to theft-linked addresses

A vulnerability in BTCPay Server was leveraged by attackers to empty hot wallets on installations that had not been updated, and Bitquery linked roughly $1.63 million in Bitcoin and Litecoin to wallet addresses tied to these incidents. According to BTCPay Server’s incident update from November 2, the breaches affected versions 2.4.1 and earlier, despite a patch having existed since August 7.

Key takeaways

• The attacks targeted BTCPay Server versions 2.4.1 and older.
• Bitquery tracked 682 wallet sweeps between October 30 and November 2.
• Affected operators were told to rebuild with fresh wallets and seeds.

BTCPay Server vulnerability exploited through administrator access

The attacker logged into affected servers as an administrator and emptied their hot wallets, according to Bitquery’s analysis. The transfers ran from October 30 through the morning of November 2.

BTCPay Server said the attacker used a different method to exploit a flaw already repaired in version 2.4.2, released on August 7. When the project issued its warning, it had seen no impact on servers already running that version or later.

This same vulnerability was already used back in August to siphon funds via LND, a Lightning Network implementation. At that time, BTCPay Server said on-chain wallets, including hot wallets, were unaffected.

Bitquery tracks transfers around the shutdown warning

Bitquery traced 18.38 Bitcoin and 3,405 Litecoin to two addresses identified by BTCPay Server. Its analysis recorded 682 sweeps, with 87% of the traced funds moving in one wave during the afternoon and evening of November 1.

The activity continued after the project’s shutdown alert. After BTCPay Server told operators to take their instances offline at 22:25 UTC on November 1, Bitquery identified 267 additional sweeps totaling around $150,000.

The approximately $1.63 million figure represents funds traced to addresses linked to the thefts, rather than a confirmed loss total. Bitquery’s analysis covered the two identified addresses and excluded other addresses and coins, including Lightning funds.

As reports arrived, BTCPay Server also asked VPS hosting providers to take affected instances offline to protect customers.

Operators urged to rebuild, not just update

Operators who had been running version 2.4.1 or an earlier release were told by BTCPay Server to migrate to a new server with a fresh wallet and seed, regardless of whether they had already applied the update. The project warned that “updating alone cannot remove access an attacker may already have gained.”

Alongside the recovery instructions for the BTCPay Server vulnerability, the project strongly urged users to install version 2.4.7. It also told operators to preserve logs and transaction records, replace exposed credentials, and avoid copying the old server installation onto a replacement.

Wallets with spending keys stored off-server, including hardware wallets, were unaffected, BTCPay Server said. The project advised keeping only operational funds on the server.

Article produced with the assistance of artificial intelligence and reviewed by the editorial team.