BTCPay Server Compromised: Theft of $1.63 Million in Cryptocurrency
In a worrying incident for cryptocurrency traders and businesses, hackers have successfully stolen approximately $1.63 million in Bitcoin and Litecoin from hot wallets associated with outdated instances of the BTCPay Server. This unfortunate event has raised significant concerns in the blockchain community, especially as the stolen funds were traced back to particular addresses linked to the theft.
On November 2, 2023, BTCPay Server, an open-source payment platform widely utilized for cryptocurrency transactions, released an incident update detailing the breach. The organization reported that the hackers targeted servers operating on version 2.4.1 or earlier of their software. Disturbingly, the attackers exploited a different method to take advantage of a vulnerability that had been patched in version 2.4.2, which was made available to users on August 7, 2023. BTCPay Server has noted that there were no impacts on servers that had already been updated to version 2.4.2 or later at the time of their warning.
As part of a thorough investigation, blockchain intelligence firm Bitquery conducted an analysis that traced 18.38 Bitcoin and 3,405 Litecoin to two specific addresses cited by BTCPay Server. The funds were moved in 682 separate transactions between October 30 and the morning of November 2. Bitquery’s findings indicated that the perpetrator had accessed the servers with administrator privileges, subsequently sweeping the hot wallets of their contents.
This exploit was not the first instance of such vulnerabilities being targeted. Previously, in August, a similar flaw had been leveraged to extract funds through LND, an implementation of the Lightning Network. At that time, BTCPay Server asserted that on-chain wallets—including those categorized as hot wallets—were unaffected by the breach. However, the current incident appears to contradict that assurance.
Interestingly, the sweeps of the compromised funds continued even after BTCPay Server’s warning to operators. Bitquery observed that 87% of the stolen funds were transferred in a significant wave on the afternoon and evening of November 1, mere hours after BTCPay Server advised users to shut down their instances at 22:25 UTC that same night. Following the alert, Bitquery detected an additional 267 transactions, cumulatively worth approximately $150,000.
One challenge in assessing the full scope of the incident lies in the nature of blockchain records, which log wallet activity rather than specific systems. Consequently, Bitquery was unable to ascertain exactly how many servers were hit in this breach—a pertinent detail complicated by the fact that the analysis did not account for other coins and addresses involved, including funds belonging to the Lightning Network. BTCPay Server also cautioned that activity observed at the two addresses might precede the reported thefts, suggesting that not all balances should necessarily be regarded as confirmed losses. As of now, the project has not disclosed an official total of the losses incurred.
In light of this alarming security breach, BTCPay Server has issued a strong recommendation to users operating on version 2.4.1 or earlier. The organization urged these operators to transition to a new server with a fresh wallet and seed, even if they have since updated their software. BTCPay Server emphasized that simply updating does not guarantee the removal of any unauthorized access that may have already been established by the attackers.
For added security, BTCPay Server advised that wallets which maintain their spending keys off the server—such as hardware wallets—remain unaffected. Consequently, they recommend that users only store operational funds within the server environment. Furthermore, those impacted by the breach should be diligent in preserving logs and transaction records, replacing any exposed credentials, and avoiding the restoration of the old server onto new infrastructures. The vulnerability had been addressed and fixed since August 7, emphasizing that the compromised wallets were those on servers that had not implemented the necessary updates.
As the cryptocurrency landscape continues to grow rapidly, this incident serves as a stark reminder of the essential need for vigilance and timely updates in securing digital assets. Cybersecurity must remain a priority for all users in the rapidly evolving world of cryptocurrency trading and transactions.