BTCPay Server Recommends Upgrading After Critical Vulnerability

The Bitcoin ecosystem is facing yet another attack on a self-hosted infrastructure service after the recent Coldcard exploit, which left a balance of over 1,700 BTC stolen, according to Galaxy Research.

BTCPay Server, an open-source, self-hosted cryptocurrency payment processor, has announced it is facing an ongoing attack by unknown threat actors affecting its codebase.

On social media, the BTCPay Server team stressed that there was a “critical vulnerability being actively exploited on BTCPay Server, which can result in the loss of funds.”

The vulnerability was disclosed by the Bitcoin Red Team, a voluntary security group that has already found thousands of vulnerabilities across hundreds of open-source projects after the Coldcard hack.

“Please update your BTCPayServer to 2.4.2 by going to Admin Dashboard -> Server -> Maintenance -> Update & verify the 2.4.2 version string in the footer. If you are unable to update right away, turn off your BTCPay Server to prevent unauthorized access until you can update,” BTCPay Server recommended.

In addition, the project prompted users to refresh macaroons and macaroons.db, two core files of the server; refresh auth strings and move funds if they are stored on a hot wallet generated using BTCPay.

While figures for this exploit have not been released, there are at least two known instances where funds were swept. Zack Herbert, co-founder and CEO of Foundation, builders of the Passport Prime device, reported that their node was drained overnight.

Hodlonaut also found that the Citadel 21 lightning node funds were drained, with the caveat that it was not holding many funds due to precautions regarding the possible activation of BIP-110.

He stressed that this attack seemed targeted, aiming at “the very heart” of the bitcoin social layer. “Coldcard and BTCPayserver. These are enthusiast/hardcore tools, used by the people who live and bleed Bitcoin. This does not feel like chance,” he concluded.