Bitcoin payment software BTCPay Server has asked users who operate servers to shut down their systems until an investigation is complete, following reports that attackers are draining some hot wallets.
BTCPay Server, which allows businesses to accept Bitcoin payments directly into their own wallets without an intermediary, issued a security alert on Sunday, November 1. In a statement reported by CoinDesk, the project said it had received reports that unauthorized parties had moved funds from hot wallets on some servers.
The initial warning called on anyone running BTCPay Server to shut down their server until the investigation was complete, without limiting the request to a specific version. The number of affected servers and the total amount lost have not yet been disclosed.
Initial findings point to older versions
In a statement about two hours later, founder Nicolas Dorier said the theft reports appeared to involve BTCPay Server versions earlier than 2.4.2. Dorier also said the project’s own publicly accessible servers, which run version 2.4.7, had not been attacked.
This statement did not confirm that all newer versions were safe. The initial call to shut down servers was also not directed only at users of older versions.
According to Dorier, the attacker logged in with an administrator account on affected servers. Investigators are looking into how the attacker obtained this access; the entry point has not yet been determined.
Why are hot wallets at risk?
BTCPay Server is open-source software that businesses run on their own servers. With the hot wallet option, the secret information needed to send funds can be stored on an internet-connected server, where transactions can also be signed. This makes it easier to send payments, but also gives anyone who takes control of the server a way to access the wallet’s funds.
Because each business manages its own installation, the project team cannot shut down all servers centrally. That is why users have been asked to shut theirs down: each server operator must take this precaution.
A vulnerability in older versions was also fixed in August
In August, BTCPay confirmed a security vulnerability in versions earlier than 2.4.2 that allowed attackers to access LND credential files. These credentials are used to run a node on Bitcoin’s Lightning payment network and could allow funds to be moved. The vulnerability was fixed in version 2.4.2.
Since it has not yet been determined how administrator access was obtained in the latest incident, a connection between the new reports and the vulnerability disclosed in August has also not been established.
Not investment advice.