BTCPay Server, an open-source crypto payment processor that businesses run on their own servers, warned that attackers are stealing Bitcoin and Litecoin from "hot wallets" on outdated instances. According to the project, the attacks targeted servers running version 2.4.1 or earlier and used a different method to exploit a vulnerability fixed in version 2.4.2 in August. The first reports surfaced around November 1.
The project says there are no credible reports of thefts from version 2.4.7, the latest release, which also fixes one critical and several medium-severity flaws found by Anthropic's open-source scanner. Hosting providers have automatically shut down some older instances.
What to do: update to the latest version. Anyone who ran version 2.4.1 or earlier is advised to move to a fresh server with a new wallet even if no theft was noticed, and to treat every secret stored on the server as compromised. The project recommends keeping only the funds needed for daily operations in a hot wallet.
