BTCPay Server Warning: Outdated Instances Targeted, Hot Wallets Drained

Key points

• Attackers are targeting BTCPay Server installations that have not been kept current.
• Spendable funds in hot wallets can be siphoned once an outdated deployment is compromised.
• No CVE has been assigned, so version checks and asset inventory matter more than scanner signatures.
• Administrators should update promptly and reduce online wallet balances.

An alert tied to BTCPay Server warns that unidentified intruders have been draining cryptocurrency from poorly maintained deployments. The common thread is not a newly published CVE but lagging installations: systems that missed updates appear to be the primary exposure. The project's warning urges operators to bring their software current and to treat hot-wallet balances as at risk until patching is verified.

This matters most to teams that self-host BTCPay Server and keep spendable funds online in hot wallets. Because the software is often deployed by merchants, nonprofits, and public-sector payment teams, an unpatched node can become both a theft target and a foothold. The department has no specific evidence that New Brunswick K-12 systems are involved, but the same hygiene rules apply to any school or district running self-managed payment infrastructure.

The absence of a CVE does not mean low risk. It means defenders cannot rely on scanner signatures alone; they need asset inventory, version checks, and payment-key reviews. Hot wallets are inherently exposed because keys live on networked hosts, so theft can occur quickly once an attacker gains access. Operators should verify official release notes and apply the latest supported version rather than waiting for a formal vulnerability identifier.

Watch for unexpected wallet outflows, changed credentials, unfamiliar API keys, or altered server configurations. If compromise is suspected, isolate the host, rotate secrets, restore from known-good backups, and move remaining funds offline. Track BTCPay Server project advisories for follow-up details and confirm all instances—including test and forgotten deployments—are upgraded.

What to do now

1. Inventory every BTCPay Server instance, including test and forgotten deployments, and record its version and owner.
2. Upgrade each instance to the latest supported release from the official source, verify the package, and confirm the running version.
3. Move high-value balances out of hot wallets into offline or cold storage, leaving only operational funds online.
4. Rotate wallet keys, API tokens, administrator passwords, and other secrets after upgrading or if exposure is suspected.
5. Review logs for abnormal withdrawals, login attempts, configuration changes, and newly created API keys; preserve evidence.
6. Restrict administrative and API access, enforce multi-factor authentication, and segregate payment hosts from general workloads.
7. Monitor BTCPay Server project advisories and repeat version checks; isolate and investigate any host showing signs of compromise.

Original source

BleepingComputer