BTCPay tells merchants to rebuild servers after $1.6m bitcoin and litecoin theft
BTCPay Server has told merchants to rebuild their payment servers and replace their wallets after attackers stole an estimated $1.6 million in bitcoin and litecoin from installations running outdated software.
The open-source payment processor said in a 2 November security advisory that installing its latest update may not protect funds if hackers have already gained access. The attacks targeted version 2.4.1 or earlier, exploiting a vulnerability that BTCPay patched on 7 August. Blockchain analytics firm Bitquery traced about $1.63 million in suspected thefts — 18.38 BTC and 3,405 LTC — across 682 wallet sweeps between 30 October and 2 November. It found 87% of the funds moved during an eight-hour window on 1 November, with the busiest hour accounting for roughly $725,000 in transfers.
BTCPay said it regretted not doing more to reach operators still running outdated installations after its August advisory, and has issued several security updates since, including version 2.4.7 on 29 October. The suspected thefts continued even after BTCPay publicly warned operators to shut down their servers: Bitquery recorded another 267 sweeps worth about $150,000 after the 1 November warning at 22:25 UTC, with transfers continuing until it stopped counting at 06:00 UTC on 2 November. BTCPay said it contacted hosting providers, including LunaNode, to take affected installations offline.
The project said it had seen no impact on servers already running version 2.4.2 or later when the November warning was issued, and that wallets whose spending keys were stored outside the server, including hardware wallets, were unaffected. But it is urging operators who previously ran vulnerable versions to migrate to entirely new server installations, even if they have since updated or noticed no missing funds, because attackers who gained administrative access may have obtained credentials or wallet secrets that remain usable after the patch. It recommends generating a new wallet with a fresh seed phrase on a trusted device, transferring remaining funds, retiring existing servers, preserving transaction records and logs, and installing the latest software on a fresh virtual machine without restoring the old system. Hosting passwords, SSH credentials, application access keys, API keys and Lightning credentials should also be replaced from a trusted device.
Bitquery's tracking showed more than 99% of the suspected stolen funds remained at addresses first used during the thefts as of early 2 November, with no identified transfers to known exchanges. The firm cautioned that its 682 recorded sweeps do not represent an equivalent number of affected merchants, as individual wallets could have been drained through multiple transactions. BTCPay has warned that some activity involving the identified addresses appears to predate the reported incidents, and it has yet to establish the complete attack timeline or determine which transactions can be conclusively attributed to the thefts. The project is continuing to collect reports and transaction records from affected operators.
What it means for Pakistan: For Pakistani merchants who accept bitcoin or litecoin through self-hosted BTCPay Server, the advisory is a direct warning: any installation still on version 2.4.1 or earlier should be treated as compromised, with wallets moved to fresh seeds and servers rebuilt. Pakistan's virtual asset framework, led by PVARA, has focused on licensing and AML rules for exchanges and custodians rather than self-hosted payment tools, so operators here rely on the project's guidance. The theft also underscores the custody risk that Pakistani regulators cite when urging users to keep digital assets with licensed providers rather than on exposed servers.
