BTCPay calls Bitcoin merchants to replace wallets after theft estimated at $1.6 million. The payment software provider warns that installing security updates may not remove attacker access, as Bitcoin and Litecoin thefts continue. BTCPay Server has urged retailers to rebuild outdated payment servers and replace wallets after hackers stole Bitcoin and Litecoin. In a security notice on November 2, the open-source Bitcoin payment software provider warned that installing the latest update may not protect funds if attackers had already compromised the server. This warning followed a series of attacks targeting systems running version 2.4.1 or lower, using an alternative method to exploit a vulnerability BTCPay patched on August 7. Blockchain analytics firm Bitquery traced approximately $1.63 million in stolen funds related to 18.38 BTC and 3,405 LTC through 682 wallet scans from October 30 to November 2. The investigation revealed that 87% of the funds were transferred within an eight-hour window on November 1, with peak hours accounting for approximately $725,000 in transfers. These findings provide an initial indication of the financial scale of the attack, although BTCPay has not confirmed the total loss or identified how many merchants were affected. BTCPay expressed regret for not doing more to reach merchants still using outdated installations after the August security notice. The project has since released additional security updates, including version 2.4.7 on October 29. The investigation revealed that 87% of the funds were transferred within an eight-hour window on November 1, with peak hours accounting for approximately $725,000 in transfers. These findings provide an initial indication of the financial scale of the attack, although BTCPay has not confirmed the total loss or identified how many merchants were affected. BTCPay expressed regret for not doing more to reach merchants still using outdated installations after the August security notice. The project has since released additional security updates, including version 2.4.7 on October 29. Wallet thefts continue despite BTCPay’s security warning. Suspected thefts persist even after BTCPay publicly warned operators to shut down their servers. According to Bitquery, an additional 267 withdrawals from wallets totaling approximately $150,000 occurred after BTCPay’s warning at 22:25 UTC on November 1. Fund transfers continued throughout the night and were still being recorded when the analytics firm ceased monitoring at 06:00 UTC on November 2. BTCPay said it contacted hosting providers, including LunaNode, to temporarily suspend affected systems as a precaution. The project received its first theft report via email at 20:56 UTC, although their investigation noted wallet withdrawals as early as that afternoon. The company stated it observed no impact from these attacks on servers running version 2.4.2 or higher when the warning was issued in November. They also confirmed that wallets with spending keys stored off-server, including hardware wallets, were unaffected by the reported thefts. However, BTCPay is urging former users of vulnerable versions to migrate to entirely new server setups, even if they have updated the software or have not detected any lost funds. The concern is that prior attackers with administrative access may have obtained login credentials or wallet secrets that remain usable even after the security vulnerability was patched. Therefore, the project recommends creating a new wallet with a new seed phrase on a trusted device and transferring any remaining funds from the old hot wallet to this new one. Operators must also deactivate existing servers, preserve relevant transaction records and logs, and install the latest supported software on a new virtual machine without restoring the old system. Server passwords, SSH login credentials, application access keys, API keys, and Lightning credentials may also have been compromised and should be replaced using trusted devices. Meanwhile, Bitquery’s tracking data shows that over 99% of the suspected stolen funds remain at addresses first used in the thefts as of early morning on November 2, with no identified transfers to known exchanges.A empresa de análise alertou que as 682 transações de retirada que eles registraram não representam o número equivalente de comerciantes afetados, pois os wallets de indivíduos individuais podem ter sido esvaziados por meio de várias transações diferentes. O BTCPay também alertou que algumas atividades relacionadas aos endereços identificados parecem ter ocorrido antes dos incidentes relatados. Eles ainda não determinaram a sequência temporal completa do ataque nem identificaram quais transações podem ser com certeza atribuídas aos roubos. O projeto continua coletando relatórios e registros de transações dos provedores afetados enquanto investiga as invasões. Segundo Oluwapelumi Adejumo