BTCPay Server warns of hot wallet thefts running on outdated software

BTCPay Server has identified an attack vector affecting older versions of its payment software after receiving reports of attackers draining funds from users’ hot wallets. 

The project said it had received no credible reports of hot wallet drains among users running its latest release, version 2.4.7 and urged operators to update their installations. 

BTCPay has not disclosed the number of affected operators, the value of stolen funds or technical details explaining how attackers accessed the wallets. It asked affected users to submit information and logs to its security team. 

Cointelegraph reached out to BTCPay Server for comment but did not receive a response before publication.

The reports come less than three months after BTCPay restricted remote Lightning access following an August attack that exploited a vulnerability to obtain Lightning Network Daemon (LND) credentials and steal funds.

It remains unclear whether the latest attack vector is connected to the August vulnerability.