BTCPay Server Attacks Drain Hot Wallets; $1.63M Traced to Linked Addresses

Attackers accessed unpatched BTCPay Server installations and emptied their hot wallets; about $1.63 million in Bitcoin (BTC) and Litecoin (LTC) was traced to addresses linked to the incidents. BTCPay Server said Nov. 2 that the affected versions were 2.4.1 and earlier. A fix shipped in version 2.4.2 on Aug. 7, and the project had seen no impact on installations running that release or newer when it issued its warning. From Oct. 30 through the morning of Nov. 2, 682 wallet sweeps sent 18.38 BTC and 3,405 LTC to two incident-linked addresses.

Also reported by The Cryptonomist.

Source: TokenPost