Crypto tills raided: merchants who skipped an update lose their coins
Between 30 October and 2 November attackers drained hot wallets on BTCPay servers running version 2.4.1 or earlier; Bitquery, an analytics firm, has so far traced about $1.63m in bitcoin and litecoin.
A flaw fixed in August was exploited months later at merchants that had not updated. With self-hosted payment infrastructure, the merchant carries the risk alone.
What happened
BTCPay Server is open-source software that lets merchants accept bitcoin payments on their own servers, without a payment provider. On 1 November reports arrived that bitcoin and litecoin had vanished from hot wallets, whose keys are kept on the server. According to BTCPay the first known drain took place at 13:46 UTC, the first report came at 20:56 and at 22:25 the project told all operators to shut their servers down. Hosts such as LunaNode took instances offline as a precaution. Versions 2.4.1 and earlier are affected; the flaw was fixed in version 2.4.2 on 7 August. Bitquery traced 18.38 BTC and 3,405 LTC at two addresses in 682 sweeps, about 87% of them on 1 November. Some 267 sweeps worth roughly $150,000 came after the warning. BTCPay itself gives no loss figure, because some of the movements may predate the thefts. Assessment: Bitquery's figure is a floor; other addresses and Lightning are excluded.
What follows
Self-hosted payment software saves fees but turns updates into a balance-sheet risk: there is no exchange that is liable and no provider that reimburses. According to BTCPay an update alone is not enough if attackers already had access; a new server, a new wallet and new credentials are needed. That costs time and sales. Funds whose keys sat on hardware wallets off the server were not affected. Assessment: for merchants that accept crypto, how much sits in the hot wallet becomes a question of risk management, like cash in the till.
What changes in practice
- Merchants
- Check the version: at 2.4.1 or earlier BTCPay advises a new server and a new wallet. Updating alone is not enough.
- Companies
- Keep only daily needs in the hot wallet and the rest in wallets whose keys are not on the server.
- Customers
- Funds at merchants whose keys were not on the server were not affected, BTCPay says.
What to watch
- An official loss figure from BTCPay
- Further addresses or Lightning losses in analyses
- How many servers still run old versions
Sources
- BTCPay Server: Security incident affecting BTCPay Server 2.4.1 and earlier
- Infosecurity Magazine: Hackers exploit BTCPay Server flaw to steal cryptocurrency
- The Hacker News: Hackers exploit BTCPay Server flaw to steal Bitcoin and Litecoin