BTCPay urges Bitcoin merchants to replace wallets after hackers steal an estimated $1.6 million

BTCPay Server has urged merchants to rebuild outdated payment servers and replace wallets after attackers stole Bitcoin and Litecoin.

In a Nov. 2 security advisory, the open-source Bitcoin payment software provider warned that installing the latest update may not protect funds if hackers have already gained access to a server.

The warning follows a series of attacks targeting installations running version 2.4.1 or earlier, using a different method to exploit a vulnerability that BTCPay patched on Aug. 7.

Blockchain analytics firm Bitquery traced approximately $1.63 million in suspected thefts involving 18.38 BTC and 3,405 LTC across 682 wallet sweeps between Oct. 30 and Nov. 2.

Its investigation found that 87% of the funds moved during an eight-hour window on Nov. 1, with the busiest hour accounting for approximately $725,000 in transfers.

The findings provide an early indication of the attack's financial scale, although BTCPay has not confirmed a total loss figure or established how many merchants were compromised.

BTCPay said it regretted not doing more to reach operators still running outdated installations after its August security advisory. The project has issued several additional security updates since then, including version 2.4.7 on Oct. 29.

Wallet thefts continued after BTCPay's security warning

The suspected thefts continued even after BTCPay publicly warned operators to shut down their servers.

According to Bitquery, another 267 wallet sweeps worth approximately $150,000 occurred after BTCPay's Nov. 1 warning at 22:25 UTC. The transfers continued through the night and were still being recorded when the analytics firm stopped counting at 06:00 UTC on Nov. 2.

BTCPay said it contacted hosting providers, including LunaNode, to take affected installations offline as a precaution. The project had received its first emailed theft report at 20:56 UTC, although its investigation documented a wallet drain earlier that afternoon.

The company said it had seen no impact from these attacks on servers already running version 2.4.2 or later when the November warning was issued. It also confirmed that wallets whose spending keys were stored outside the server, including hardware wallets, were unaffected by the reported thefts.

However, BTCPay is urging operators who previously ran vulnerable versions to migrate to entirely new server installations, even if they have since updated their software or have not noticed any missing funds.

The concern is that attackers who previously gained administrative access may have obtained credentials or wallet secrets that remain usable after the underlying vulnerability is patched.

Consequently, the project recommends generating a new wallet with a fresh seed phrase on a trusted device and transferring any remaining funds from the old hot wallet.

Operators must also retire their existing servers, preserve transaction records and relevant logs, and install the latest supported software on a fresh virtual machine without restoring the old system.

Potentially exposed hosting passwords, SSH credentials, application access keys, API keys and Lightning credentials should also be replaced from a trusted device.

Meanwhile, Bitquery's tracking showed that more than 99% of the suspected stolen funds remained at addresses first used during the thefts as of early Nov. 2, with no identified transfers to known exchanges.

The analytics firm cautioned that its 682 recorded sweeps do not represent an equivalent number of affected merchants, as individual wallets could have been drained through multiple transactions.

BTCPay has also warned that some activity involving the identified addresses appears to predate the reported incidents. It has yet to establish the complete attack timeline or determine which transactions can be conclusively attributed to the thefts.

The project is continuing to collect reports and transaction records from affected operators as it investigates the intrusions.