Hackers have stolen cryptocurrency from hot wallets on outdated BTCPay Server instances, with blockchain analysis tracing about $1.63m in Bitcoin and Litecoin to addresses linked to the thefts.
BTCPay Server said in an incident update on November 2 that the thefts hit servers running version 2.4.1 or earlier of the open-source payment platform, and that attackers had used a different method to exploit a vulnerability fixed in version 2.4.2, released on August 7.
It had seen no impact on servers already running 2.4.2 or later when it issued its warning.
An analysis by blockchain intelligence company Bitquery traced 18.38 Bitcoin and 3405 Litecoin to two addresses named by BTCPay Server, moved in 682 sweeps between October 30 and the morning of November 2. It said the thief signed in to the servers as an administrator and swept their hot wallets.
The flaw had already been exploited in August to steal funds through LND, a Lightning Network implementation, though BTCPay Server said at the time that on-chain wallets, including hot wallets, were not affected.
Read more on hot wallet breaches: Bitget Restarts Bitcoin Withdrawals Following $387.5m Wallet Breach
Sweeps Continued After BTCPay’s Warning
Bitquery said 87% of the traced funds moved in a single wave on the afternoon and evening of November 1. It counted 267 further sweeps, worth about $150,000, after BTCPay Server told operators at 22:25 UTC that night to shut down their instances.
The firm could not tell how many servers were hit, since the blockchain records wallets rather than systems. It also left out other addresses and coins, including Lightning funds, making its figure a floor.
BTCPay Server added that some activity at the two addresses appears to predate the reported thefts, so their balances should not be treated as confirmed losses. The project has not published a loss total.
BTCPay Server Urges Hot Wallet Users to Rebuild
BTCPay Server urged operators of version 2.4.1 or earlier to move to a fresh server with a new wallet and seed, even if they had since updated, warning that “updating alone cannot remove access an attacker may already have gained.”
It said wallets whose spending keys are held off the server, including hardware wallets, were unaffected, and advised keeping only operational funds on the server.
Operators should also preserve logs and transaction records, replace exposed credentials and avoid restoring the old server onto a new one, the project said.
The fix had been available since August 7. The wallets that were emptied sat on servers that had never installed it.