BTCPay Urges Bitcoin Merchants to Replace Wallets After Theft Estimated at $1.6 Million. The payment software provider warns that installing security updates may not remove attacker access, as Bitcoin and Litecoin thefts continue. BTCPay Server has called on retailers to rebuild outdated payment servers and replace wallets after hackers stole Bitcoin and Litecoin. In a security notice on November 2, the open-source Bitcoin payment software provider warned that installing the latest update may not protect funds if attackers had already compromised the server. This warning followed a series of attacks targeting systems running version 2.4.1 or lower, exploiting a different method to leverage a vulnerability BTCPay patched on August 7. Blockchain analytics firm Bitquery traced approximately $1.63 million in stolen funds linked to 18.38 BTC and 3,405 LTC across 682 wallet scans from October 30 to November 2. The investigation revealed that 87% of the stolen funds were transferred within an eight-hour window on November 1, with a peak hour accounting for roughly $725,000 in transfers. These findings offer an initial indication of the financial scale of the attack, though BTCPay has not confirmed the total loss or identified how many merchants were affected. BTCPay expressed regret for not doing more to reach merchants still using outdated installations after the August security notice. Since then, the project has released several additional security updates, including version 2.4.7 on October 29. The investigation revealed that 87% of the stolen funds were transferred within an eight-hour window on November 1, with a peak hour accounting for roughly $725,000 in transfers. These findings offer an initial indication of the financial scale of the attack, though BTCPay has not confirmed the total loss or identified how many merchants were affected. BTCPay expressed regret for not doing more to reach merchants still using outdated installations after the August security notice. Since then, the project has released several additional security updates, including version 2.4.7 on October 29. Wallet thefts persist despite BTCPay’s security warning. Suspected thefts continue even after BTCPay publicly warned operators to shut down their servers. According to Bitquery, an additional 267 withdrawals from wallets totaling approximately $150,000 occurred after BTCPay’s warning at 22:25 UTC on November 1. Fund transfers continued throughout the night and were still being recorded when the analytics firm ceased monitoring at 06:00 UTC on November 2. BTCPay said it contacted hosting providers, including LunaNode, to temporarily suspend affected systems as a precautionary measure. The project received its first theft report via email at 20:56 UTC, though their investigation noted wallet withdrawals as early as that afternoon. The company stated it observed no impact from these attacks on servers running version 2.4.2 or higher when the November warning was issued. They also confirmed that wallets with spending keys stored off-server—including hardware wallets—were unaffected by the reported thefts. However, BTCPay is urging former users of vulnerable versions to migrate to entirely new server setups, even if they have updated their software or detected no missing funds. The concern is that prior attackers with administrative access may have obtained login credentials or wallet secrets that remain usable even after the security vulnerability was patched. Therefore, the project recommends creating a new wallet with a fresh seed phrase on a trusted device and transferring any remaining funds from the old hot wallet to this new one. Operators must also deactivate existing servers, preserve relevant transaction records and logs, and install the latest supported software on a new virtual machine without restoring the old system. Server passwords, SSH credentials, application access keys, API keys, and Lightning credentials may have been compromised and should be replaced using trusted devices. Meanwhile, Bitquery’s tracking data shows that over 99% of the suspected stolen funds remain at addresses first used in the thefts as of early November 2, with no identified transfers to known exchanges.The company's analysis warns that the 682 withdrawal transactions they recorded do not represent an equivalent number of affected merchants, as individual wallets may have been drained through multiple separate transactions. BTCPay also cautions that some activities related to the identified addresses appear to have occurred prior to the reported incidents. They have not yet determined the full timeline of the attack or definitively identified which transactions were caused by the thefts. The project continues to collect reports and transaction records from affected merchants as part of its investigation into the breaches. By Oluwapelumi Adejumo