BTCPay patches wallet-shaped hole as attackers race AI to the hot keys 🔐

BTCPay Server, a self-hosted Bitcoin payment processor, warned users on Friday that attackers are actively exploiting a critical vulnerability that could lead to stolen funds and urged administrators to install version 2.4.2 immediately and confirm the update in the server footer. "If you are unable to update right away, turn off your BTCPay Server to prevent unauthorized access until you can update," the project wrote in a post on X. The team also instructed operators to replace authentication credentials known as macaroons, recreate the macaroons.db file, and refresh authentication strings for other Lightning Network backends. "If you generated a hot on-chain wallet in BTCPay, you want to move those funds and recreate the wallet," BTCPay added.

The project credited members of the Bitcoin Red Team with reporting the vulnerability but did not disclose how the flaw works, when the attacks began, how many servers were compromised, or whether any funds were actually stolen. BTCPay Server did not immediately respond to a request for comment. The disclosure lands against a backdrop of AI-assisted exploits hitting crypto projects at a faster clip. In May, security researcher Taylor Hornby used Anthropic's Claude Opus 4.8 to surface a four-year-old vulnerability in Zcash that could have allowed attackers to mint unlimited counterfeit ZEC. In August, hardware wallet maker Coldcard's parent Coinkite said it suspected attackers used AI to find a firmware flaw linked to more than $100 million in stolen BTC. On Tuesday, Bitcoin swap provider Boltz suspended its service after multiple exploits, citing AI-assisted attacks finding vulnerabilities faster than its team could patch them. The latest BTCPay incident adds another entry to that running tally.