SECURITY ALERT
The software was free and self-hosted.
So was the job of updating it.
Attackers have been sweeping the hot wallets of merchants running BTCPay Server, the open-source bitcoin payment processor, on versions 2.4.1 or older, the project said on X at 04:07 UTC on Monday.
It says it has “no credible reports” of drained hot wallets on the latest release, 2.4.7.
A hot wallet keeps its keys on the server, so whoever controls the server can spend from it.
The attacker “managed to log in as admin” on the affected instances, lead developer Nicolas Dorier wrote overnight. A blog post with details is promised.
What happened, in UTC
- Sun 1 Nov, 22:25. BTCPay Server reports hot wallets “being swept by unauthorized attackers” and tells operators to shut instances down.
- Mon 2 Nov, 00:28. Dorier says the reports seem to involve versions before 2.4.2.
- 01:52. Dorier: “We have traces that pre 2.4.2 vulnerabilities were used.”
- 04:07. The project names 2.4.1, released on 23 Jul, or older. Some hosting providers, LunaNode among them, switched off customers’ instances.
- 04:13 and 04:44. Dorier publishes the attacker’s addresses.
No loss figure has been published.
The addresses
Bitcoin: bc1p0f7wmcnesrapznymf9ljdn04pudgmh96sqtrm9vmgqxdh666fh8qvn63r7
Litecoin: ltc1qp49tmfdueyaqrmgrx0uyx4uegyygt8yt02whee
On mempool.space, the bitcoin address first received funds on 30 Oct and had taken in about 18.76 BTC, roughly $1.47 million, in 528 transactions by 04:55 UTC. Almost all of it had already moved on.
About 1.64 BTC of that arrived after the shutdown warning, in some 190 small deposits.
The Litecoin address had received about 3,383 LTC, around $189,000, and sent nothing.
That is our read of public data. Received is not the same as stolen, and BTCPay has not said how many merchants were hit.
2.4.2 shipped in August with a fix for a flaw the project said was already being exploited. “It doesn’t seem to be a new vulnerability,” Dorier wrote. Which old flaw was used has not been named.
Unlike the Binance theft, there is no company balance sheet behind these wallets. The merchant is the custodian.
Protect yourself
- Running 2.4.1 or older? Keep the instance off until it is on 2.4.7.
- If your hot wallet was swept, Dorier says to treat the whole server as compromised, not just the seed. BTCPay asks affected users to send details to [email protected].
- Keep only what payouts need in a hot wallet.
If the deposits were still landing hours after the warning, who was not listening?
Corrections and new evidence: [email protected]
This article is for information only and is not investment advice.