Critical vulnerability discovered in BTCPay Server

[hugeblack]

There have been reports that hot wallets on BTCPay Servers are being swept by scammers. BTCPay Server's investigation discovered vulnerabilities in versions 2.4.1 and older. The team recommends that if you are running older instances of the software, to shut them down.

The attack targeted .macaroon credential files used by LND through which merchant Lightning wallets could be drained.
The good side of the story is that the Bitcoin base protocol was not affected and thus the Lightning Network settlements will be affected.
Frankly, with the limited use of the Lightning Network (and low fees), such attacks may make the scope of LN much less than in the past.

[DaveF]

Update:

BTCPay Server has released version 2.4.3-rc4 of the software. It contains a security update that addresses the vulnerabilities that the Bitcoin Red Team and other researchers identified and reported. This is a release candidate but BTCPay Server still recommends that users perform the upgrade. Bugs may be present, though.

More information is available here:
https://x.com/btcpayserver/status/2087959120515101035

There are security issues with BTCPay Server again.

There have been reports that hot wallets on BTCPay Servers are being swept by scammers. BTCPay Server's investigation discovered vulnerabilities in versions 2.4.1 and older. The team recommends that if you are running older instances of the software, to shut them down. There are no reports of drains for users running the latest 2.4.7 release of BTCPay Server. The best option is to update it or alternatively shut it down.

https://x.com/BtcpayServer/status/2117020340815819262

OK, I am really confused.
The old version that had a vulnerability that was reported & fixed back in August and people were still running even older versions of it?
With 2.4.4 & 2.4.5 & 2.4.6 all being posted as security releases I can see missing one or even 2 of them letting things shake out a bit, but running 3+ month old versions. What are people thinking?

Not victim blaming here, but it does make you wonder why they didn't update.

-Dave

[avp2306]

There are security issues with BTCPay Server again.

There have been reports that hot wallets on BTCPay Servers are being swept by scammers. BTCPay Server's investigation discovered vulnerabilities in versions 2.4.1 and older. The team recommends that if you are running older instances of the software, to shut them down. There are no reports of drains for users running the latest 2.4.7 release of BTCPay Server. The best option is to update it or alternatively shut it down.

https://x.com/BtcpayServer/status/2117020340815819262

Again and again, for some reason these attacks have been carried out in succession since the Coldcard, Ledger and Exchange Tier 1 attacks and now BTCPay Server is the latest target.
Is this some kind of organized attack targeting all the crypto ecosystems that exist today?

Most probably this is done by organize groups. Since individual hacker cannot probably penetrate easily on those platforms.

Although BTC didn't disclosed their potential suspects, but I think it might get revealed soon.

With recent hacking issue happened nowadays. It seems that the hackers became more dangerous. I will not get surprised to see another big platform will get victimized by hacking in future. I think we need to prepare on it and stop relying on exchange or other third party platform when it comes storing our funds.

[Pmalek]

Update:

BTCPay Server has now released a full security advisory on its blog about the recent security incident.
In it they explain that both bitcoin and litecoin has been stolen from hot wallets. The targeted servers were running BTCPay Server 2.4.1 and earlier versions. This attack was different and used another method than the vulnerability that BTCPay Server fixed with release 2.4.2.

Here is a link to the security advisory if anyone is interested in reading it:
https://blog.btcpayserver.org/btcpay-server-security-incident-2-4-1-and-earlier/

They mention two addresses connected to the hacks. One bitcoin and one litecoin address:
https://mempool.space/address/bc1p0f7wmcnesrapznymf9ljdn04pudgmh96sqtrm9vmgqxdh666fh8qvn63r7
https://live.blockcypher.com/ltc/address/ltc1qp49tmfdueyaqrmgrx0uyx4uegyygt8yt02whee/