Attackers drain BTCPay Server hot wallets on unpatched instances
A flaw fixed back in August is now being exploited against self-hosted BTCPay Server instances still on 2.4.1 or earlier, draining Bitcoin and Litecoin from hot wallets since 1 November.
BTCPay Server, the open-source Bitcoin payment processor, confirmed on 2 November that attackers have been draining hot wallets on self-hosted instances still running version 2.4.1 or earlier. The first drain was logged at 13:46 UTC on 1 November, the project received its first theft report just over seven hours later, and it warned the wider community less than ninety minutes after that.
The fix shipped in version 2.4.2 on 7 August, so the servers being hit are ones that never updated in nearly three months. BTCPay Server says patching alone isn’t enough: operators still on 2.4.1 or earlier are told to move to a fresh server with a new wallet, sweep any remaining funds off the old one, take it offline, and rotate every credential, since a server an attacker already reached can’t be trusted just because the hole is now closed.
Why it matters: if you or a client run a self-hosted payment processor, or any self-hosted software handling funds or secrets, this is a reminder that a patch’s release date isn’t a deadline, it’s just the start of the window attackers eventually find. Checking what version you’re actually running against the changelog is worth doing on a schedule, not only when a CVE lands in your inbox.
The caveat: BTCPay Server hasn’t published a confirmed total loss figure, and says the destination addresses it has tracked so far shouldn’t be treated as a complete tally.