Howdy, Stranger!

It looks like you're new here. If you want to get involved, click one of these buttons!

Sign In Register

Quick Links


Server.net
CPLicense.net
VPS Server
Buy VPN
Vultr
VMs for AI
HostDare
ReliableSite White-Label Dedicated Hosting for Resellers
VDS.net
InterServer VPS
Best VPN
High-Performance Bare Metal Server Solutions
Karvl.com
Server Mania Cloud Hosting
DataWagon Hosting
AlphaVPS Hosting
Evoxt.com
Clouvider
VPS Hosting with NVMe
ReliableSite White-Label Dedicated Hosting for Resellers
Rabisu - Hosting Solutions
CloudLinux
MeduzaVPN
Servury - Anonymous & Privacy-focused VPS Hosting
Animated Silicon Kiwi cloud ad featuring VPS from $4.90/month, 100 GB S3 storage from $1.49/month, Kiwi Apps from $12/month and cloud backup from $3/month
Lium GPU Pods
Yeap Cloud
GenixNode - KVM NVMe Gen4 VPS from $2.99/mo in 14 locations

Categories

In this Discussion

Home › News › Security
New on LowEndTalk? Please Register and read our Community Rules.

All new Registrations are manually reviewed and approved, so a short delay after registration may occur before your account becomes active.

BTCPay Server Alert!

JoshRJoshR Member, Patron Provider
edited 1:09AM in Security

https://x.com/BtcpayServer/status/2117020340815819262?a=z_omr-oOtooVF6B0kaw&s=19

We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers.

If you're running an instance, please shut it down (./btcpay-down.sh) until we complete the investigation.

Thanked by 8beermachine forest JohnnySac Decicus gsea4 oloke rpqu Murv

Comments

  • labzelabze Member, Patron Provider

    Do it.

    I was about to do my monthly withdrawal. Found out that someone already did that for me.

    FML.

    Lesson learned. Time to get smarter about crypto.

    Thanked by 6beermachine JohnnySac Decicus Xrmaddness RIYAD monsoon73
  • gsea4gsea4 Member

    @rpqu said:
    Fuck

    Thanked by 2nghialele rpqu
  • AdvinAdvin Member, Host Rep
    edited 3:07AM

    We had some cryptocurrency in our hot wallets on BTCPayServer, we transferred it out at ~8:06PM EST and did not get swept. I'm not really sure what protected us, it could just be that we were behind a WAF.

    Thanked by 2Francisco oloke
  • MannDudeMannDude Patron Provider, Veteran

    @labze said:
    Do it.

    I was about to do my monthly withdrawal. Found out that someone already did that for me.

    FML.

    Lesson learned. Time to get smarter about crypto.

    What version are/were you on? Can PM me.

    I did my own withdrawals this morning, thankfully.

    Thanked by 1Francisco
  • MynymboxMynymbox Member, Host Rep

    Why does someone use the hot wallet on BTCPay? There is zero need for that kind of setup

  • AdvinAdvin Member, Host Rep
    edited 2:48AM

    @Mynymbox said:
    Why does someone use the hot wallet on BTCPay? There is zero need for that kind of setup

    We used hot wallets mostly for convenience, it was much easier to handle refunds and payouts, especially if you switch devices often and don't want to keep wallets on your device or have multiple members on your team.

  • MannDudeMannDude Patron Provider, Veteran

    @labze said:
    Do it.

    I was about to do my monthly withdrawal. Found out that someone already did that for me.

    FML.

    Lesson learned. Time to get smarter about crypto.

    Also, can you share:

    • Does the withdrawal appears in your recent transaction list?
    • To what address(es) were the withdrawals made to?
    • All coin types drained?
  • AdvinAdvin Member, Host Rep
    edited 3:07AM

    @MannDude said:

    @labze said:
    Do it.

    I was about to do my monthly withdrawal. Found out that someone already did that for me.

    FML.

    Lesson learned. Time to get smarter about crypto.

    Also, can you share:

    • Does the withdrawal appears in your recent transaction list?
    • To what address(es) were the withdrawals made to?
    • All coin types drained?

    Would also be interesting to know the exact time the drains started happening, we keep requests logs of our BTCPayServer instance so I can maybe look. I checked the past 24 hours and couldn't find anything abnormal.

  • MynymboxMynymbox Member, Host Rep

    @Advin said:

    @Mynymbox said:
    Why does someone use the hot wallet on BTCPay? There is zero need for that kind of setup

    We used hot wallets mostly for convenience, it was much easier to handle refunds and payouts, especially if you switch devices often and don't want to keep wallets on your device or have multiple members on your team.

    That's all not really an issue with real installed wallets. You never ever should have hot wallets activated

  • MynymboxMynymbox Member, Host Rep

    @MannDude said:

    @labze said:
    Do it.

    I was about to do my monthly withdrawal. Found out that someone already did that for me.

    FML.

    Lesson learned. Time to get smarter about crypto.

    Also, can you share:

    • Does the withdrawal appears in your recent transaction list?
    • To what address(es) were the withdrawals made to?
    • All coin types drained?

    Maybe it is not just a simple withdrawal. If it is possible to get the seed phrase you have lost the control over your wallet (s).

  • MannDudeMannDude Patron Provider, Veteran

    @Advin said:

    @MannDude said:

    @labze said:
    Do it.

    I was about to do my monthly withdrawal. Found out that someone already did that for me.

    FML.

    Lesson learned. Time to get smarter about crypto.

    From the BTCPay Telegram:

    We encourage all victims to submit details to [email protected]. Please include the version of your BTCPay Server in report.

    &&

    If there are any security researches with history of recovering funds & contacts with exchanges, I'll gladly share impacted addresses with you.

    Looks like BTC is being sent to: https://mempool.space/address/bc1p0f7wmcnesrapznymf9ljdn04pudgmh96sqtrm9vmgqxdh666fh8qvn63r7

  • rpqurpqu Member

    @gsea4 said:

    @rpqu said:
    Fuck

    Yes, exactly . Fuck

  • lyserlyser Member

    Crap, please withdraw funds be safe.

  • JoshRJoshR Member, Patron Provider

    @MannDude said:
    Looks like BTC is being sent to: https://mempool.space/address/bc1p0f7wmcnesrapznymf9ljdn04pudgmh96sqtrm9vmgqxdh666fh8qvn63r7

    Total received ‎18.76448601 BTC already. ($1,470,753.66 USD)

    Thanked by 3forest rpqu Xrmaddness
  • MannDudeMannDude Patron Provider, Veteran

    @JoshR said:

    @MannDude said:
    Looks like BTC is being sent to: https://mempool.space/address/bc1p0f7wmcnesrapznymf9ljdn04pudgmh96sqtrm9vmgqxdh666fh8qvn63r7

    Total received ‎18.76448601 BTC already. ($1,470,753.66 USD)

    Yep, seems mostly automated too. Saw some deposits of like, $0.27. So, no matter if you have a big balance or a small balance, it's ripe for the taking.

  • JoshRJoshR Member, Patron Provider

    Update:
    https://x.com/BtcpayServer

    Our incident response investigation identified an attack vector targeting instances running versions 2.4.1 (Jul 23, 2026) or older.

    We have no credible reports of hot wallet drains for users running the latest 2.4.7 release. We again urge everyone to keep their BTCPay Server updated.

    If you were impacted, please send all details and logs to [email protected]

    Thanked by 1forest
Sign In or Register to comment.