BTCPay tells merchants to dump old wallets after $1.63M drain

BTCPay is telling Bitcoin merchants to burn it all down and start over. In a Nov. 2 security advisory, the open-source payment processor warned that slapping on the latest patch won't lock hackers out — if they already got in, they may still be holding keys and credentials that work just fine. The fix, per BTCPay, is a brand-new server, a brand-new wallet and a brand-new seed phrase generated on a device you actually trust.

The damage is coming into focus thanks to blockchain analytics firm Bitquery, which traced roughly $1.63 million in suspected thefts — 18.38 BTC and 3,405 LTC — across 682 wallet sweeps between Oct. 30 and Nov. 2. The action was brutally concentrated: 87% of the funds moved during an eight-hour stretch on Nov. 1, and the single busiest hour accounted for about $725,000 in transfers. BTCPay hasn't confirmed a total loss figure or said how many merchants got hit.

The attacks targeted installations running version 2.4.1 or earlier, exploiting a vulnerability BTCPay patched back on Aug. 7. The project admits it regrets not doing more to reach operators still sitting on outdated installs after that August advisory, and it's pushed out several updates since, including version 2.4.7 on Oct. 29.

Even a public warning didn't stop the bleeding. Bitquery recorded another 267 sweeps worth about $150,000 after BTCPay's Nov. 1 alert at 22:25 UTC, with transfers rolling through the night until the firm stopped counting at 06:00 UTC on Nov. 2. BTCPay says it contacted hosting providers, including LunaNode, to pull affected installations offline as a precaution. Its first emailed theft report landed at 20:56 UTC, though its own investigation logged a wallet drain earlier that afternoon.

Servers already on version 2.4.2 or later showed no impact when the November warning went out, according to BTCPay, and wallets with spending keys stored off-server — hardware wallets included — were untouched. For everyone else, the cleanup list is long: retire the old server, preserve transaction records and logs, spin up a fresh virtual machine without restoring the old system, and swap out every hosting password, SSH credential, app access key, API key and Lightning credential from a trusted device.

As of early Nov. 2, Bitquery found more than 99% of the suspected stolen funds still sitting at addresses first used in the thefts, with no identified transfers to known exchanges. The firm cautioned that 682 sweeps don't equal 682 victims, since a single wallet can be drained through multiple transactions. BTCPay also flagged that some activity tied to those addresses appears to predate the reported incidents, and it hasn't pinned down the full timeline or which transactions are conclusively theft. The project is still collecting reports from affected operators.