BTCPay Server says an attack vector targeted self-hosted payment instances running version 2.4.1 or earlier, after reports that attackers drained hot wallets. The project has urged operators to update to version 2.4.7.
BTCPay Server lets businesses accept Bitcoin and other digital assets directly into their own wallets. Its maintainer initially advised operators to shut down servers while the unauthorized payments were investigated.
Founder Nicolas Dorier said the attacks did not target public servers. The investigation examined how an attacker could log in as an administrator to instances running versions earlier than 2.4.2. The project said it had no credible reports of hot wallet drains on the latest 2.4.7 release.
On October 29, BTCPay Server disclosed a critical vulnerability found with Anthropic’s Frontier OSS scanner and released version 2.4.7 as an emergency security update. The project later confirmed that the recent attack vector involved versions earlier than 2.4.2, but has not clarified which flaw was exploited.
Version 2.4.2, released on August 7, came with a warning about an actively exploited flaw that exposed LND credential files and could let attackers control affected Lightning nodes and steal funds. BleepingComputer said it had not received a response to its questions about the current attacks by publication time. The project asked affected users to send details and activity logs to its security team.
Comments
0No comments yet. Be the first to comment.