A vulnerability exists in BTCPay Server versions 2.4.1 and earlier, leading to the theft of funds from Bitcoin and Litecoin hot wallets. Attackers exploited the vulnerability, which was patched in version 2.4.2 on August 7th, to gain administrator privileges. Nicolas Dorier, founder of BTCPay Server, confirmed that servers running versions prior to 2.4.2 were affected, while users running version 2.4.7 reported no losses.
The official recommendation is for users to immediately transfer funds from their old hot wallets to their new wallets, take the old servers offline, and install the latest version. Simply updating the software version cannot eliminate the risk; funds stored outside of hardware wallets or other servers are unaffected. Some service providers, such as LunaNode, have already automatically shut down the risky instances.
