That’s according to a report Monday (Nov. 2) from CoinDesk, which says the attackers in question were draining so-called “hot wallets” on some of those servers.
BTCPay’s open-source software lets anyone run the system on their servers, the report said. As there are no middlemen, businesses accept bitcoin payments directly into their own wallets, and BTCPay allows them to run these as hot wallets, which remain connected to the internet.
According to CoinDesk, the ease of these transactions also comes with risks. For example, merchants’ servers can send coins on their own, without the merchant approving it. This means anyone who hacks into a server can send that crypto to their own address.
And because every merchant hosts the software on their own servers, there is no “master switch” to hit if something goes wrong, the report added. It’s why BTCPay needed to ask each server owner to shut down, as it can’t do it for them, CoinDesk added.
“We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers. If you’re running an instance, please shut it down (./btcpay-down.sh) until we complete the investigation,” BTCPay said in a post on X.
The news follows a series of attacks on “cold wallets,” which store private keys but are not — like hot wallets — connected to the internet. Once thought to be off-limits from criminals, a software flaw in devices from the company Coinkite this summer revealed their vulnerability.
In a more recent attack, hackers drained $90 million from devices made by cryptocurrency hardware wallet company Ledger.
“The incident did not break bitcoin’s encryption or reverse transactions on its blockchain. It wasn’t a wrench attack where attackers stole a physical device, tricked its owner into revealing a password or installed malware on an internet-connected computer,” PYMNTS wrote in August on the Coinkite hack. “Instead, the failure occurred at the point of a supposedly secure device.”
The incident with BTCPay took place against the backdrop of last week’s record-setting hack on crypto exchange Binance. That attack involved the theft of more than $6 billion, the largest such exploit in the history of the crypto sector.
