BTCPay Server, an open-source Bitcoin payment processor, told operators to shut down their instances after reports that unauthorized attackers were draining hot wallets. The alert named no affected versions and announced no patch.
BTCPay Server told operators on Sunday to shut down their instances after receiving reports that unauthorized attackers were draining hot wallets. The open-source Bitcoin payment processor posted its alert at 5:25 p.m. ET on Nov. 1.
The project told operators to run ./btcpay-down.sh and to leave instances shut down until it completes its investigation.
The alert leaves key questions open
The alert gave no confirmed loss amount or tally of affected instances. It also did not identify vulnerable versions or configurations, or announce a patch. Its shutdown instruction was not limited to a particular version.
BTCPay is self-hosted software, so the shutdown decision sits with individual server operators. Its wallet documentation explains that the hot wallet feature uses a seed stored on the server to sign transactions. That lets funds move without an external signing device.
An August flaw exposed Lightning credentials
The warning follows an August incident in which BTCPay confirmed that attackers had stolen funds from users of LND, software for running Lightning payments nodes. The project's advisory for that incident says a vulnerability in versions before 2.4.2, including its release candidates, let unauthenticated remote attackers obtain LND credential files.
Those credentials could be used to control a node and move funds, and version 2.4.2 fixed the flaw. However, BTCPay said its own onchain wallets, including hot wallets, were not affected by that earlier vulnerability, though funds in LND's own onchain wallet could still be at risk.
Sunday's alert did not say whether the reported sweeps were connected to the August vulnerability.
Source: The Defiant
Trading involves risk.
Risk Disclaimer
