BTCPay Server: Vulnerability in the old version led to theft of funds from hot wallets, users are advised to migrate immediately

The open-source Bitcoin payment processing tool BTCPay Server has received multiple reports of unauthorized fund theft from its Bitcoin and Litecoin hot wallets on the platform. The project team released an investigation update confirming that the attack targeted servers running BTCPay Server version 2.4.1 or earlier. The attackers exploited a vulnerability that was fixed in version 2.4.2 on August 7, gaining administrative access to the servers through various methods and draining the hot wallet funds.

BTCPay Server founder Nicolas Dorier confirmed that only servers running versions prior to 2.4.2, particularly version 2.4.1, were affected; users running the latest version 2.4.7 have not reported any credible losses. Some affected service providers, including LunaNode, have automatically shut down at-risk older instances. The official recommendation for users still using version 2.4.1 or earlier is to immediately transfer any remaining funds in old hot wallets to a new wallet created with a completely new mnemonic, take the old server offline while retaining relevant logs, and then install the latest version on a new virtual machine and connect the new wallet, ensuring not to restore the old server entirely to the new machine.

Simply updating the software version is not enough to eliminate the risk, as attackers may have gained persistent access to the old server. Funds stored outside the server, such as those in hardware wallets, were not affected by this incident. The vulnerability is related to a flaw fixed in August of this year, when attackers had manipulated nodes by obtaining LND administrative credentials. As of now, this vulnerability has not been assigned a CVE number and is not listed in CISA's known exploited vulnerabilities catalog.