BTCPay's warning calls for a new wallet, not just an update

BTCPay Server says it received reports on 1 November of Bitcoin and Litecoin being stolen from hot wallets. Its investigation found the attacks targeted servers running 2.4.1 or earlier. According to the project, the attackers used a different method to exploit a vulnerability already fixed in 2.4.2, released in August.

BTCPay says it has seen no impact from these attacks on servers that were already running 2.4.2 or later when it issued its 1 November warning. It has not published a total amount stolen in this notice. A hot wallet holds spending keys on the server, so an emptied balance is only one possible sign of exposure.

1. 1

   Check the running version. Identify every BTCPay instance and whether it was running 2.4.1 or earlier at the time of the warning. Record any later update separately.

2. 2

   Protect remaining funds and evidence. Follow BTCPay's recovery guidance for sweeping remaining hot-wallet funds with a new seed. Preserve relevant logs and transaction records before taking the old server offline.

3. 3

   Rebuild on a clean host. Provision a fresh machine, install the latest supported release from trusted sources, and connect a new wallet. Do not restore the entire old server onto it.

Wallets whose spending keys stayed off the server, including hardware wallets, were not affected by the reported thefts. BTCPay still advises rebuilding an older exposed server. Check what other secrets that host could reach, and treat any signs of unauthorized access as a wider incident.