Hackers have successfully stolen cryptocurrency from hot wallets hosted on outdated BTCPay Server instances. The breach specifically targeted servers running version 2.4.1 or earlier of the open-source payment platform, according to Infosecurity Magazine.
Blockchain analysis conducted by Bitquery traced approximately $1.63 million in Bitcoin and Litecoin to addresses linked to the thefts. Attackers exploited a vulnerability that was officially patched in version 2.4.2, which was released on August 7. The perpetrators gained administrative access to the servers and performed 682 sweeps of hot wallets between October 30 and November 2. Despite a security warning issued by the project on November 1, 267 additional sweeps occurred after operators were advised to shut down their systems.
Bitquery noted that 87% of the stolen funds were moved in a single wave. BTCPay Server has urged all affected operators to migrate to fresh servers with new wallets and seeds, warning that simply updating the software is insufficient to remove unauthorized access. The project emphasized that wallets with keys held off-server, such as hardware wallets, remain secure. This incident highlights the critical importance of maintaining updated software, as the vulnerability had been known for months before the widespread exploitation began.
Source: Infosecurity Magazine
