Loading post from X…
View post on X
The investigation update gives neither a confirmed loss amount nor a count of affected instances. It asks affected operators to send details and logs to security@btcpayserver.org.
Updating After the Shutdown Alert
Version 2.4.7 is already available, following its Oct. 29 release. Its notes recommend updating, especially for servers shared by multiple merchants.
For standard Docker installations, the project's maintenance documentation provides an SSH update route using btcpay-update.sh. The web interface also offers Server Settings → Maintenance → Update.
For operators who took instances offline, the written incident update urges updates but gives no explicit restart instruction. BTCPay also said hosting providers may have automatically shut down instances to prevent older versions from being exploited, thanking LunaNode and other providers for acting.
BTCPay developer Nicolas Dorier said there was “no reason to panic” for users who had updated at least once since the release of 2.4.2, and cautioned against keeping too much money in hot wallets.
Dorier separately said investigators had traces that “pre 2.4.2 vulnerabilities were used.” He did not identify a specific flaw in that post. In an earlier update, he reported that an attacker had managed to log in as an administrator on affected instances.
The project's August advisory said version 2.4.2 fixed a vulnerability that exposed credentials for LND, software for Lightning payments, allowing attackers to control nodes and move funds. It explicitly said BTCPay's own onchain wallets, including hot wallets, were not affected by that flaw. The new investigation update does not establish that the current drains used the same vulnerability.
Dorier said a more detailed blog post would follow.
thedefiant.io
