Attacker logged in as admin on old BTCPay servers before hot-wallet drains, founder says

On Sunday, hot-wallet sweeps affected BTCPay Server instances running releases older than 2.4.2, founder Nicolas Dorier said, with the attacker logging in as an administrator through a method still under investigation. BTCPay’s later update narrowed the attack vector to instances on version 2.4.1, released July 23, or earlier, and the project urged operators to shut down instances with ./btcpay-down.sh while it investigated. Because BTCPay is self-hosted and its hot-wallet mode stores the payment-signing seed on the server, whoever controls that server can move coins. Version 2.4.2, released August 7, patched a critical vulnerability that let unauthenticated attackers steal LND macaroon credentials; BTCPay said it has not determined whether that bug or another pre-2.4.2 flaw was used.