BTCPay Urges Fresh Servers for Affected Old Instances, Beyond a Version Update
BTCPay’s November 2 advisory links attacks to 2.4.1 and earlier. It recommends a fresh server and new wallet for affected old instances, even if subsequently updated.
BTCPay Server’s November 2 incident advisory says reported Bitcoin and Litecoin hot-wallet thefts targeted version 2.4.1 and earlier. Investigators identified a different exploitation method for a vulnerability fixed in 2.4.2 on August 7. The guidance goes beyond installing a newer release.
What the recovery advice changes
For instances running 2.4.1 or earlier, the project strongly recommends a fresh server and a new wallet, including where operators updated after the November 1 warning. It says updating alone cannot remove access already obtained by an attacker. For servers already on 2.4.2 or later at that warning, the project reports no observed impact from these attacks. That is an incident-specific observation, not a universal security guarantee.
OrangeX.com Analysis
Our assessment is that patching and recovering a potentially compromised machine address different problems. An unchanged wallet balance does not establish that access was never gained. The advisory also says the full transaction timeline remains unconfirmed, so the listed destination addresses’ balances are not a confirmed loss total. Operators should follow the project’s recovery guidance and preserve relevant records; the article does not establish losses for any particular deployment.
Related Reports
HKMA and HKUST Launch Post-Quantum Planning Toolkit for Banks
The HKMA and HKUST launched a PQC Toolkit on November 2. It supports bank transition planning after an initial readiness score of 2.3/10; full readiness by 2030 is a target.
Chainalysis Discloses Customer Data Access as Security Investigation Continues
Chainalysis says customer identity records were accessed, with no evidence to date of access to investigation content, clear-text passwords or session tokens.
Cursor Flags Two Malicious Claude Code Extension Versions
Cursor’s October 29 notice, updated October 30, identifies malicious Anthropic.claude-code versions 2.1.312 and 2.1.313 distributed for macOS and Windows.
