Top story · Bitcoin

BTCPay Server tells users to switch off their servers after reports of drained hot wallets

BTCPay Server, the free open-source Bitcoin payment tool, asked self-hosters on Sunday to shut down their instances while it investigates reports that attackers drained hot wallets. Founder Nicolas Dorier says the cases appear to involve releases older than 2.4.2.

• The project gave no loss figure, server count or fix; its public servers on 2.4.7 were not attacked.
• Dorier says the attacker logged in as an administrator; how that access was obtained is unknown.
• In August, thefts came from a flaw in pre-2.4.2 versions that exposed LND credential files.