BTCPay Server said its investigation identified an attack vector targeting installations running version 2.4.1 or earlier after reports that attackers had drained users’ hot wallets. It said it had received no credible reports of such drains on the latest release, version 2.4.7, and urged operators to update. Earlier, it had urged operators to shut down their servers while it investigated the withdrawals.
BTCPay has not disclosed how many operators were affected, how much was stolen or how attackers accessed the wallets. It is unclear whether this attack vector is connected to an August vulnerability that was used to steal funds.
