Odaily Planet Daily report: On November 1, BTCPay Server, an open-source Bitcoin payment processing tool, received multiple reports of unauthorized fund theft from its Bitcoin and Litecoin hot wallets. On November 2, the project team released an investigation update confirming the attack targeted servers running BTCPay Server version 2.4.1 or earlier. The attackers exploited a vulnerability that had been patched in version 2.4.2 on August 7, using various methods to gain administrative access to the servers and drain funds from hot wallets. BTCPay Server founder Nicolas Dorier confirmed that only servers running versions prior to 2.4.2, particularly version 2.4.1, were affected; no credible loss reports have been received from users running the latest version 2.4.7. Some affected service providers, including LunaNode, have automatically shut down vulnerable older instances. The official recommendation is for users still on version 2.4.1 or earlier to immediately transfer any remaining funds from their old hot wallets to a new wallet created with a completely new mnemonic phrase, decommission the old server while preserving relevant logs, and then install the latest version on a brand-new virtual machine connected to the new wallet—do not restore the entire old server onto a new machine. Simply updating the software version is insufficient to eliminate risk, as attackers may have established persistent access on the old server. Funds stored outside the server, such as those in hardware wallets, were not affected by this incident. This vulnerability is related to one patched in August of this year, when attackers previously compromised LND administrative credentials to manipulate nodes. As of now, this vulnerability has not been assigned a CVE identifier and is not listed in CISA’s Known Exploited Vulnerabilities catalog.
BTCPay Server Warns Users to Migrate from Outdated Versions Following Security Breach
KuCoinFlashShare
Summary
BTCPay Server urged users to upgrade from outdated versions following a security breach that affected hot wallets on November 1. The vulnerability, patched in version 2.4.2 on August 7, allowed attackers to steal funds by gaining administrative access. On-chain data shows no verified losses for users on version 2.4.7. Affected providers, such as LunaNode, have shut down vulnerable servers. Users are advised to transfer funds to new wallets, decommission old servers, and reinstall on fresh virtual machines. Altcoins to watch may experience shifts as users reassess their security practices. The vulnerability, related to a prior LND node exploit, does not have a CVE number and is not listed in CISA’s catalog.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.