BlockBeats report: On August 8, the Bitcoin payment processing project BTCPay Server warned users that its server has a critical vulnerability currently under active attack, which could allow attackers to gain unauthorized access and result in fund loss.
BTCPay Server has announced on social platform X that administrators must immediately upgrade to version 2.4.2 and confirm that the server footer displays the update as complete. If an upgrade cannot be performed promptly, the official recommendation is for users to temporarily shut down BTCPay Server to prevent further attacks.
Additionally, BTCPay Server recommends that users rotate any potentially exposed macaroon credentials, recreate the macaroons.db file, and refresh authentication strings for other Lightning Network backends.
The official team strongly advises that if users have created a hot on-chain wallet in BTCPay Server, they should immediately transfer all funds from the wallet and recreate it.
Currently, BTCPay Server has not disclosed the specific details of the vulnerability, the start time of the attack, the number of affected servers, or whether any funds have been stolen. The vulnerability was reported by a member of the Bitcoin Red Team.
This incident comes at a time when AI-assisted vulnerability discovery has drawn attention from the crypto industry. In recent security incidents involving multiple crypto projects, researchers and companies have noted that AI tools are accelerating the detection of code vulnerabilities and may also be used by attackers to automate the identification of security flaws.