The developers of the BTCPay Server payment system are warning about cyberattacks in which attackers drain cryptocurrency from operators’ wallets. The problem has primarily affected outdated installations, and both bitcoin and litecoin have been stolen. Administrators of compromised instances must therefore implement additional security measures immediately.
You might be interested in: Solana has undergone its biggest change in six years
Attackers exploited an old security flaw
BTCPay Server allows merchants to accept bitcoin payments without intermediaries, which means that all responsibility for security lies directly with the server administrator. The first reports of thefts reached the developers on November 1, and they promptly urged operators to preventively shut down their instances using the command ./btcpay-down.sh. Hosting providers, including LunaNode, subsequently disconnected the affected servers. The investigation confirmed that the targets were versions 2.4.1 and older, in which attackers exploited a vulnerability the developers had already fixed on August 7 in version 2.4.2.
The targets were so-called hot wallets, which store private keys directly on an internet-connected server, allowing an attacker with access to transfer funds without the owner’s knowledge. The analytics firm Bitquery linked unauthorized transfers worth approximately USD 1.63 million on the Bitcoin and Litecoin networks to the suspicious activity, with some transactions continuing even after the official warning was published. However, BTCPay Server cautions that the total damage and the exact number of victims cannot yet be confirmed with certainty.
Also read: Trust Wallet review: Take control of your cryptocurrencies with confidence
A simple system update may not be enough
According to the project, servers updated to version 2.4.2 or newer by November 1 at the latest showed no signs of compromise. For operators of older and compromised installations, however, the developers recommend a far more radical approach than a mere update. Administrators should move all remaining cryptocurrency to a new wallet with a freshly generated seed, shut down the original server completely, and perform a clean installation from scratch. Changing passwords and access credentials immediately is a given.
Wallets that keep private keys off the server – such as hardware wallets – were not affected by the attack, according to the developers. BTCPay Server therefore strongly reminds users of the proven rule: keep only the minimum balances needed for everyday operations in hot online wallets and store the rest in cold offline storage.
You might also like: Bitcoin is waiting for the Fed
Sources:
- BTCPay Server (official announcement and security recommendations): https://btcpayserver.org
- Bitquery (blockchain analytics and monitoring of suspicious transactions): https://bitquery.io
- LunaNode (cloud hosting and infrastructure): https://www.lunanode.com
Photo source: Unsplash
