BTCPay Server is urging operators to rebuild older installations after Bitcoin and Litecoin theft reports received November 1. Its November 2 notice identifies version 2.4.1 and earlier as the targets.
An August fix, a different attack
The project says attackers used another method to exploit a vulnerability patched in 2.4.2 on August 7. That release was already a security emergency: its release notes warned that the critical flaw was being exploited and urged rapid updates.
The earlier advisory focused on exposed credentials for LND, a Lightning Network implementation. It described unauthenticated access to credential files that could allow control of an LND node and the movement of funds. The attacks reviewed for that advisory targeted those files; the project’s assessment then excluded BTCPay’s own on-chain wallets. The advisory nevertheless urged users of other Lightning implementations to update.
The November reports instead concern hot wallets, whose spending keys reside on the server.
Recovery goes beyond an update
BTCPay recommends a fresh virtual machine and wallet for installations running 2.4.1 or earlier at its November 1 warning, even if updated afterward or without visible theft. Its instructions call for a new seed on a trusted device, transfer of remaining hot-wallet funds, preservation of records, and retirement of the old server.
The replacement should run the latest supported release. Operators should replace exposed credentials from a trusted device and avoid restoring the old machine wholesale.
BTCPay reports no impact from these attacks on servers already running 2.4.2 or later at that warning.
Sources: November incident and recovery notice; August security advisory; BTCPay Server 2.4.2 release notes.
Image: AI-generated editorial illustration created for DaySec, not a photograph of the incident.
