Bitcoin Merchants Told to Power Down BTCPay Servers as Attackers Empty Wallets

On Sunday, the team behind BTCPay Server asked every business running its payment software to stop the system right away. Reports had come in that intruders were emptying funds from wallets kept on merchant machines. Owners were told to run the stop command and wait for further word. No figure for stolen money, number of victims or patch was shared.

Why Self Hosted Bitcoin Wallets Are Exposed

Each merchant controls its own server, so the project has no way to switch anything off centrally. The weak point is the hot wallet, where the secret seed sits on a machine that is always online and signs payments by itself. Whoever takes over that machine can move the coins elsewhere.

BTCPay Server Version 2.4.2 and Admin Access

Roughly two hours later, founder Nicolas Dorier said the victims seem to run versions older than 2.4.2. The team’s own public servers, on version 2.4.7, were untouched. The attacker had logged in with an administrator account, and how that

access was obtained remains unknown.

Earlier Lightning Flaw and Binance Hack

In August, a bug in versions before 2.4.2 exposed credential files for LND, the software behind Lightning nodes, and funds were stolen before a fix arrived. This alert follows the Binance hack, which drained over $6 billion on Thursday.