Attacker logged in as admin on old BTCPay servers before hot-wallet drains, founder says

Hot-wallet sweeps reported on Sunday appear to involve servers running releases older than 2.4.2, said Nicolas Dorier, founder of BTCPay Server. The attacker logged in as admin on those instances and the team is still figuring out how. Investigation pins the attack vector on 2.4.1 releases or earlier BTCPay sent out an alert at 5:25 p.m. ET Sunday. It counseled anyone running an instance to shut it down with ./btcpay-down.sh until the investigation is over. Dorier posted about 2 hours later. BTCPay’s own public servers running 2.4.7 were not attacked, he said. Dorier later stated the team had traces that “pre 2.4.2 vulnerabilities were used.” BTCPay’s update at 11:07 p.m. ET narrowed the target.

BeCrypto News shows a short excerpt and links to the publisher. The full report belongs to Cryptopolitan.