BTCPay Server Tells Users to Update After Hot Wallet Thefts Hit Older Software

TLDR BTCPay Server told users to shut down their servers on Sunday after reports of attackers draining hot wallets. On Monday, the project said the attack targeted versions 2.4.1 and earlier, and it has no credible reports of drains on version 2.4.7. Founder Nicolas Dorier said an attacker logged in as an administrator on the hit servers, but the team does not know how. BTCPay has not shared the number of affected servers or the amount stolen. In August, a separate flaw in versions before 2.4.2 let attackers steal funds through Lightning credentials. BTCPay Server, a free tool that businesses use to accept bitcoin payments, asked users to shut down their servers on Sunday. The project said it had received reports that attackers were draining hot wallets.

BeCrypto News shows a short excerpt and links to the publisher. The full report belongs to CoinCentral.