Attackers emptied hot wallets on BTCPay Server installations running version 2.4.1 or older, and the project confirmed on Monday that Bitcoin and Litecoin were stolen. The BTCPay hack hit people who run the payment software on their own servers.
BTCPay Server is free software. A shop installs it on its own machine and takes bitcoin directly, no payment company in between. Its hot wallet keeps the spending keys on that same machine, which means whoever gets in can move the coins. The project has not said how many servers were hit or how much was taken.
Servers on 2.4.2 or newer were fine, the project said. Wallets with their keys kept elsewhere, hardware wallets included, were untouched.
What did the project say about the hack?
The project said the first drain described in the BTCPay hack reports took place at 13:46 UTC on Sunday 1 November, and that it does not know when the attackers first started. The first email reporting a theft reached it at 20:56 UTC. It then asked hosting companies, including LunaNode, to take customers’ BTCPay servers offline, and at 22:25 UTC it told operators on X to shut their servers down.
On Monday it published a full advisory that named version 2.4.1 and earlier as the target. LunaNode and other hosts had by then switched off some instances as a precaution, the project said, so a customer on a hosted plan may find the server already offline.
Which servers does the hack put at risk?
2.4.1 shipped on 23 July. Two weeks later, on 7 August, came 2.4.2, and its GitHub release notes call the bug it fixes “a critical vulnerability that is being actively exploited” and tell everyone to update fast. According to the advisory, the BTCPay hack used a different method to exploit that same vulnerability.
BTCPay said servers already on 2.4.2 or later when it warned on 1 November have shown no effect, and it has no credible reports of drained wallets on 2.4.7, the latest release. It also wrote that it wished it had done more to reach users still running older versions.
How much money did the hack move?
The advisory lists one Bitcoin address and one Litecoin address from the BTCPay hack reports. BTCPay said some activity at those addresses appears to predate the thefts it has heard about, and that their balances should not be read as a confirmed total of losses.
Blockstream’s public records put 19.9 BTC into the Bitcoin address across 685 deposits. At $77,300 that is about $1.5 million. Nearly all of it, 19.2 BTC, landed after 13:46 UTC on 1 November. The busiest hour was 16:00 UTC, when 8.8 BTC came in. Most deposits were small. The middle one was about 0.0012 BTC, and the largest was 1.86 BTC.
The Litecoin address has received 4,240 LTC in 198 deposits, about $231,000 at $54.56, the first at 13:17 UTC on 1 November. Both addresses named by BTCPay were still receiving deposits on Monday afternoon. By 16:30 UTC the records listed 19.84 BTC of outgoing payments at the Bitcoin address, leaving about 0.07 BTC, and about 760 LTC of outgoing payments at the Litecoin one.
What should owners do after the BTCPay hack?
For anyone on 2.4.1 or older, BTCPay recommends moving to a fresh server with a new wallet, even if no theft was noticed and even if the server was updated after the warning. Updating does not remove access an attacker may already hold, the project said.
The steps it gives start with a new wallet made on a trusted device with a new seed, since reusing the old seed leaves the coins at risk. Remaining hot wallet funds are swept into it, the old server is taken offline with its logs kept, and passwords and access keys the old machine could reach are replaced from a trusted device. The old server should not be copied onto the new one.
People who lost funds are asked to email [email protected] with their version, the time they noticed, and the transaction IDs, and to report the theft to local authorities. The project says never to send a seed phrase or password.
Does the BTCPay hack change anything for Bitcoin itself?
The BTCPay hack concerns BTCPay’s own software, not the Bitcoin network. Bitcoin traded near $77,300 on Monday, down 0.9% over 24 hours on CoinGecko, and the amount in question is small next to the market.
For a shopper paying a store, the payment works as before. A store whose server was switched off may be unable to take bitcoin until it moves to a new one. This is a separate case from the Binance hack reported on Friday, and more cases like it are filed under Web3 Watch.
What is still unknown about the BTCPay hack?
BTCPay has not said how many servers the BTCPay hack reached, and it said it has not worked out which transactions at the two addresses belong to the incident. Its advisory adds that it is reviewing incident reports, and, pointing to a rise in automated attacks that use AI, it asked all users to install updates as they come out and to keep only the money needed for daily use in a hot wallet.
Owners can check their version at the bottom of the BTCPay login page. Anything below 2.4.2 falls in the group the project says the BTCPay hack targeted.
