BTCPay urges merchants to replace wallets after estimated $1.63M Bitcoin, Litecoin theft
In brief
- BTCPay's Nov. 2 advisory warns updating may not protect funds if attackers already had server access
- Attacks targeted version 2.4.1 or earlier, exploiting a flaw BTCPay patched on Aug. 7
- Bitquery traced about $1.63 million across 682 sweeps; BTCPay hasn't confirmed a total
- Hardware wallets and other wallets with keys stored off the server were unaffected
What the advisory says
The attacks targeted installations running version 2.4.1 or earlier, using a different method to exploit a vulnerability BTCPay patched on Aug. 7. The project's shipped several security updates since then (including version 2.4.7 on Oct. 29), and it said it saw no impact on servers already running 2.4.2 or later when the November warning went out. Wallets with spending keys stored off the server, hardware wallets included, weren't affected.
Updating alone may not be enough.
Attackers who previously had administrative access may have obtained credentials or wallet secrets that still work after patching, so BTCPay is telling operators who ran vulnerable versions to migrate to entirely new server installations, even if they've updated and no funds look missing. It recommends generating a new wallet with a fresh seed phrase on a trusted device, moving remaining funds out of the old hot wallet, retiring existing servers (while preserving records and logs) and installing the latest software on a fresh virtual machine without restoring the old system. Hosting passwords, SSH credentials, access keys, API keys and Lightning credentials should be replaced as well.
BTCPay said it regretted not doing more to reach operators still on outdated installations after its August advisory. It also contacted hosting providers, including LunaNode, to take affected installations offline as a precaution.
Bitquery's numbers
Blockchain analytics firm Bitquery traced approximately $1.63 million in suspected thefts (18.38 BTC and 3,405 LTC) across 682 wallet sweeps between Oct. 30 and Nov. 2. About 87% of the funds moved in an eight-hour window on Nov. 1; the busiest hour alone accounted for roughly $725,000. Another 267 sweeps worth about $150,000 came after BTCPay's Nov. 1 warning at 22:25 UTC, and transfers were still being recorded when Bitquery stopped counting at 06:00 UTC on Nov. 2.
Bitquery cautioned that 682 sweeps don't equal 682 merchants, since a single wallet could be drained through multiple transactions. As of early Nov. 2, more than 99% of the suspected stolen funds sat at addresses first used in the thefts, with no identified transfers to known exchanges.
What's still unknown
BTCPay hasn't confirmed a total loss figure or how many merchants were compromised. It got its first emailed theft report at 20:56 UTC, though its investigation documented a wallet drain earlier that afternoon, and it's warned that some activity involving the identified addresses appears to predate the reported incidents. The full attack timeline isn't established yet. BTCPay is still collecting reports and transaction records from affected operators.
Frequently asked questions
Which BTCPay Server versions were affected by the attacks?
According to BTCPay's Nov. 2 advisory, as reported by CryptoSlate, the attacks targeted installations running version 2.4.1 or earlier. They exploited a vulnerability BTCPay patched on Aug. 7. BTCPay said it saw no impact on servers already running version 2.4.2 or later when the November warning was issued.
Why isn't updating BTCPay Server enough?
BTCPay warned that installing the latest update may not protect funds if hackers had already gained access to a server. Attackers with prior administrative access may have obtained credentials or wallet secrets that remain usable after patching. That's why it's urging operators who ran vulnerable versions to migrate to entirely new server installations.
Were hardware wallets affected by the BTCPay thefts?
No. BTCPay confirmed that wallets whose spending keys were stored outside the server, including hardware wallets, were unaffected. The thefts involved hot wallets, and BTCPay recommended moving remaining funds from old hot wallets to a new wallet created with a fresh seed phrase on a trusted device.
