BTCPay Server issued a security advisory on November 2, urging merchants using its open‑source Bitcoin payment software to rebuild outdated payment servers and replace wallet credentials after a series of thefts.
Scope of the attacks
Blockchain analytics firm Bitquery traced approximately $1.63 million in suspected thefts involving 18.38 BTC and 3,405 LTC across 682 wallet sweeps between October 30 and November 2. The majority of the funds moved during an eight‑hour window on November 1, with the busiest hour accounting for about $725,000.
Vulnerable versions and mitigation
The attacks targeted installations running BTCPay version 2.4.1 or earlier, exploiting a vulnerability that was patched on August 7. BTCPay noted that servers already running version 2.4.2 or later showed no impact when the November warning was issued.
Despite the warning, Bitquery recorded an additional 267 wallet sweeps worth roughly $150,000 after BTCPay’s November 1 alert, continuing through the early hours of November 2.
Recommended actions for merchants
- Generate a new wallet with a fresh seed phrase on a trusted device.
- Transfer any remaining funds from the old hot wallet.
- Retire existing servers, preserve logs, and install the latest software on a new virtual machine.
- Replace potentially exposed passwords, SSH credentials, API keys and Lightning credentials from a trusted device.
BTCPay also contacted hosting providers, such as LunaNode, to take affected installations offline as a precaution.
Current status of stolen funds
More than 99% of the suspected stolen funds remained at the addresses first used during the thefts as of early November 2, with no identified transfers to known exchanges. Bitquery cautioned that the number of sweeps does not directly correspond to the number of compromised merchants, as a single wallet could be drained through multiple transactions.
Ongoing investigation
BTCPay continues to collect reports and transaction records from affected operators while investigating the full timeline and scope of the intrusions.
