After upgrading BTCPay Server, don’t assume the old server is safe to keep using.
The project team confirmed on November 2 that recent hot-wallet theft attacks targeted versions 2.4.1 and earlier. Hot wallets store spending keys on the server; patching a software vulnerability does not automatically revoke access an attacker may have already obtained. An unchanged balance does not rule out a compromised machine.
The official recovery advice for instances running these older versions is more thorough: create a wallet using a trusted device and a brand-new seed phrase, then transfer out the remaining hot-wallet funds. Keep the relevant logs, decommission the old machine, and install the latest supported version on a brand-new virtual machine. Replace any credentials that may have been exposed. Do not restore the entire old server or reuse the old seed phrase.
This case is a reminder to merchants running their own payment services: software updates, server rebuilds, and key changes address different problems. The project team says wallets with spending keys stored outside the server were not affected by this theft, but still recommends rebuilding servers running older versions.
Keep only the funds needed for day-to-day operations in hot wallets; on-chain transactions still carry security risks.
Binance Wallet invitation code: MOLLY666
The project team confirmed on November 2 that recent hot-wallet theft attacks targeted versions 2.4.1 and earlier. Hot wallets store spending keys on the server; patching a software vulnerability does not automatically revoke access an attacker may have already obtained. An unchanged balance does not rule out a compromised machine.
The official recovery advice for instances running these older versions is more thorough: create a wallet using a trusted device and a brand-new seed phrase, then transfer out the remaining hot-wallet funds. Keep the relevant logs, decommission the old machine, and install the latest supported version on a brand-new virtual machine. Replace any credentials that may have been exposed. Do not restore the entire old server or reuse the old seed phrase.
This case is a reminder to merchants running their own payment services: software updates, server rebuilds, and key changes address different problems. The project team says wallets with spending keys stored outside the server were not affected by this theft, but still recommends rebuilding servers running older versions.
Keep only the funds needed for day-to-day operations in hot wallets; on-chain transactions still carry security risks.
Binance Wallet invitation code: MOLLY666
