Hackers exploit outdated BTCPay Server instances to steal cryptocurrency - MSSP Alert
Hackers have stolen approximately $1.63 million in Bitcoin and Litecoin from outdated BTCPay Server instances, exploiting a patched vulnerability.
The breach specifically targeted servers running version 2.4.1 or earlier of the open-source payment platform, according to Infosecurity Magazine. Blockchain analysis conducted by Bitquery traced approximately $1.63 million in Bitcoin and Litecoin to addresses linked to the thefts.
Exploited Vulnerability
Attackers exploited a vulnerability that was officially patched in version 2.4.2, released on August 7. The perpetrators gained administrative access to the servers and performed 682 sweeps of hot wallets between October 30 and November 2.
Despite a security warning issued by the project on November 1, 267 additional sweeps occurred after operators were advised to shut down their systems.
Recovery Recommendations
BTCPay Server has urged all affected operators to migrate to fresh servers with new wallets and seeds, warning that simply updating the software is insufficient to remove unauthorized access. The project emphasized that wallets with keys held off-server, such as hardware wallets, remain secure.
This incident highlights the critical importance of maintaining updated software, as the vulnerability had been known for months before the widespread exploitation began.
Related
