WiretechnologyDextape brief
Is Your BTCPay Server Safe? What the Hot Wallet Drain Investigation Shows
The BTCPay Server team links hot wallet drains to versions 2.4.1 and older and reports no credible attacks on its latest 2.4.7 release.
Dextape brief
Intruders obtained administrator rights on old BTCPay Server installations and emptied their hot wallets, according to an investigation by the project's team. The total losses have not been disclosed. Merchants run BTCPay Server on their own machines to accept Bitcoin, and the free payment processor is open source. Late on Nov. 1, the developers sounded the alert and told operators to stop their instances entirely. A follow-up narrowed the target to version 2.4.1 and older, with no credible drains reported on 2.4.7. Dorier, the founder, described an intruder who signed in with admin privileges, though the method remains unknown. Vulnerabilities predating version 2.4.2 have been found, and the case is at least the second theft in three months.
Why it matters: Operators who leave self-hosted payment software unpatched can lose funds held in hot wallets, showing that timely updates matter for Bitcoin merchants.
Read the full story
Dextape context
Built from Dextape’s own wire, stories and glossary.
Terms in this story
- Hot wallet
- A wallet whose keys sit on an internet-connected device, such as a phone app or browser extension.
Mentioned in this story
Open a coin page for its current price.