BTCPay Server Attack Targets Outdated Nodes
Key Summary
BTCPay Server confirmed Wednesday that unauthorized attackers drained hot wallets by exploiting older instances running version 2.4.1 or lower. Founder Nicolas Dorier stated that public servers running release 2.4.7 evaded the compromise entirely. The platform urged operators to update immediately while investigators examine the administrative access vectors.
Key Bullets
- Attackers drained hot wallets on BTCPay Server instances running version 2.4.1 and older according to developer findings.
- Founder Nicolas Dorier confirmed public servers operating on release 2.4.7 remained entirely secure during the incident.
- Investigators are reviewing administrative access traces while impacted operators submit logs to security at btcpayserver.org.
- The security scare follows a separate LND macaroon vulnerability disclosed three months prior by the open-source payment processor.
Hot Wallet Drains Hit Outdated Servers
BTCPay Server exposed an active exploit vector Wednesday targeting payment processor instances running version 2.4. 1 or older following reports of unauthorized hot wallet sweeps. The open-source cryptocurrency payment processor stated in incident logs that instances running the latest 2.4. 7 release avoided the compromise entirely. Platform founder Nicolas Dorier confirmed through public communications that attackers leveraged vulnerabilities present in software versions predating 2.4. 2 to gain unauthorized administrative access. Developers have not disclosed the exact financial losses or the precise number of servers affected by the breach.
The development follows a separate security disclosure from three months prior when attackers stole funds by obtaining LND admin macaroon credentials from vulnerable instances. BTCPay Server currently operates as a self-hosted platform allowing merchants to process direct Bitcoin and Lightning Network transactions without third-party intermediaries. Affected operators must forward diagnostic data directly to the project security team while running immediate updates on all active nodes.
Developers Urge Immediate Software Updates
Project maintainers directed all server administrators to apply patch updates immediately after initial warnings advised shutting down exposed nodes entirely. Investigators are still parsing server logs to determine how intruders bypassed standard authentication barriers on legacy installations. The payment processor requested that any victims submit transaction hashes and system traces to security@btcpayserver. org for forensic evaluation. Public infrastructure maintained by the core team remained unaffected by the exploit wave.
The incident arrives shortly after a massive security breach at Binance where attackers drained $6.00B in digital assets in a historic exploit attributed by the FBI to state-sponsored hackers. Self-hosted payment infrastructure continues facing aggressive targeting from threat actors scanning networks for unpatched software versions. Traders and merchants rely heavily on rapid patch deployment to secure funds routed directly through self-custodied nodes.
About CryptoNewsFree Market Intelligence Wire
The CryptoNewsFree Market Intelligence Wire provides rapid, objective coverage of breaking crypto developments, regulatory actions, and market liquidity trends. Our reporting strictly follows our Editorial & Verification Standards.