CryptoSlate
BTCPay is urging merchants who ran vulnerable payment servers to replace their wallets and rebuild on fresh installations after Bitquery traced about $1.63 million in suspected Bitcoin and Litecoin thefts. The firm identified 18.38 BTC and 3,405 LTC across 682 wallet sweeps from Oct. 30 to Nov. 2. BTCPay says installing an update may not protect funds if attackers already accessed a server.
Why it matters
The attacks targeted installations running version 2.4.1 or earlier, using a different method to exploit a vulnerability BTCPay patched on Aug. 7. The project said it had seen no impact on servers already running version 2.4.2 or later when it issued its Nov. 1 warning. Hardware wallets and other wallets whose spending keys were stored off-server were not affected by the reported thefts.
A software patch cannot revoke credentials or wallet secrets attackers may already have obtained. BTCPay recommends generating a fresh wallet seed on a trusted device, moving remaining funds, retiring the old server and installing supported software on a new virtual machine without restoring the old system. Exposed hosting passwords, SSH credentials, API keys and other access credentials should also be replaced.
Market impact
Bitquery counted 267 additional wallet sweeps worth about $150,000 after BTCPay's Nov. 1 warning. It said 87% of the suspected stolen funds moved during an eight-hour window, with roughly $725,000 transferred in the busiest hour. More than 99% of tracked funds remained at addresses first used in the thefts as of early Nov. 2, with no identified transfers to known exchanges.
The figures do not establish how many merchants were affected: multiple sweeps may involve one wallet, and BTCPay has not confirmed a total loss or the full attack timeline. The project is collecting reports as its investigation continues.
Frequently asked questions
-
How much Bitcoin and Litecoin did Bitquery trace in the suspected thefts?
Bitquery traced about $1.63 million, comprising 18.38 BTC and 3,405 LTC across 682 wallet sweeps from Oct. 30 to Nov. 2.
-
Why does BTCPay recommend a new server even after merchants install an update?
Attackers may already have gained access and obtained credentials or wallet secrets. Updating software does not necessarily invalidate information they acquired.
-
Which BTCPay server versions were targeted in the reported attacks?
The attacks targeted installations running version 2.4.1 or earlier. BTCPay said it saw no impact on servers running version 2.4.2 or later when it issued its Nov. 1 warning.
-
What should merchants do with potentially exposed credentials and wallet funds?
BTCPay recommends making a fresh wallet on a trusted device, transferring remaining funds, retiring the old server and replacing exposed passwords, SSH credentials, API keys and other access credentials.
-
Do the 682 wallet sweeps mean 682 merchants were affected?
No. Bitquery cautioned that one wallet could have been drained in multiple transactions, so the sweep count does not establish the number of affected merchants.
CoinDesk
WuBlockchain
Crypto Rank News
Crypto News
TheBlock