The developers of the BTCPay Server project, an open-source cryptocurrency payment processor, have issued an urgent security warning to platform users after detecting a series of attacks aimed at draining "Hot Wallets" associated with servers running older versions of the software.
Vulnerability Details
Nicolas Dorier, the project founder, confirmed that investigations revealed an attack vector specifically targeting versions prior to 2.4.2, where attackers were able to gain Administrator privileges on those servers. A critical vulnerability was previously discovered via the Frontier OSS scanning tool from Anthropic, which prompted the team to release the emergency security update 2.4.7.
The team noted that the attacks did not target public servers but focused on self-hosted instances that had not been updated. As of now, there are no credible reports of users who have upgraded to version 2.4.7 being compromised.
What Should Users Do?
The project emphasized the need for immediate action to protect digital assets, especially for users still relying on version 2.4.1 or older:
- Immediate Update: All operators must upgrade to version 2.4.7 via Server Settings (Server Settings → Maintenance → Update).
- Shut Down Servers: It is strongly recommended to shut down affected servers immediately as a precautionary measure until the update process is complete.
- For Docker Users: Updates can be performed by accessing the server via SSH, entering the installation directory (btcpayserver-docker), and executing the update command (./btcpay-update.sh).
Why Does This News Matter?
The importance of this warning lies in the nature of BTCPay Server as a self-hosted payment solution; the user bears full responsibility for the security of their server and digital assets without an intermediary. Exploiting administrative access vulnerabilities means attackers have the ability to take full control over payment processing and verification, directly threatening the funds of merchants and users. The team has requested that affected parties send details of incidents to their security email (security@btcpayserver.org) and report the loss of funds to local authorities.