Coinfomania and crypto.news both report a BTCPay Server hot wallet breach and shutdown advisory, but they name different version numbers as the one operators should update to.
What all sources agree on
- Unauthorized attackers gained access to BTCPay Server installations and drained connected Bitcoin hot wallets.
- BTCPay Server advised operators to shut down their server instances.
- The vulnerability is associated with older versions of the software, and BTCPay Server urged operators to update.
Where the reports disagree
1Which version number is cited as the fix/safe version
BTCPay Server has officially acknowledged the issue, advising all operators to immediately update to version 2.4.2 to mitigate risks.
The project’s investigation identified an attack vector affecting installations running version 2.4.1 or older, while the latest 2.4.7 release has no credible reports of wallet drains.
What would settle it: BTCPay Server's own published security advisory specifying the affected and patched version numbers.
What to make of it
Treat the existence of the breach, the hot wallet drains, and the shutdown advisory as established; do not rely on either outlet's specific version number until BTCPay Server's own advisory is checked directly.
Treat the existence of the breach, the hot wallet drains, and the shutdown advisory as established; do not rely on either outlet's specific version number until BTCPay Server's own advisory is checked directly.