BTCPay Server — ochiq manbali kriptovalyuta to'lov protsessori —ning saqlovchisi foydalanuvchilarni so'nggi versiyani o'rnatishga chaqirdi, chunki xakerlar eski versiyalarda ishlaydigan nusxalardagi "hot wallet"lardan mablag'larni o'g'irlashmoqda.
Dastlab operatorlarga ruxsatsiz to'lovlar bo'yicha to'liq tekshiruv yakunlanguncha serverlarini o'chirish tavsiya etildi.
BTCPay Server loyihasi bizneslarga o'z-o'zini boshqaradigan to'lovni qayta ishlash yechimini taqdim etadi, bu ularga Bitcoin va boshqa raqamli aktivlarni to'g'ridan-to'g'ri o'z hamyonlariga qabul qilish, to'lov vositachilarini yo'q qilish yoki platforma qayta ishlash to'lovlarini to'lamaslik imkonini beradi.
U to'lov hisob-fakturalari va to'lovni tekshirishni, shu jumladan Lightning Network orqali to'lovlarni ham boshqaradi.
Dushanba kuni erta tongda saqlovchi "2.4.1 (2026-yil 23-iyul) yoki undan oldingi versiyalarda ishlaydigan nusxalarni nishonga olgan hujum vektorini aniqlaganini" aytdi va foydalanuvchilarni 2.4.7 versiyasiga yangilashni qat'iy tavsiya qildi.
BTCPay asoschisi Nikolas Dorier hujumlar ommaviy serverlarga qaratilmaganini aytdi. Tekshiruv tahdid aktori 2.4.2 dan oldingi versiyalarda ishlaydigan nusxalarga administrator sifatida qanday kirganini aniqlashga qaratildi.
29-oktabrda kompaniya Anthropic'ning Frontier OSS skaneri orqali aniqlangan muhim zaiflikni e'lon qildi, bu 2.4.7 versiyasini favqulodda xavfsizlik yangilanishi sifatida chiqarishga sabab bo'ldi.
Biroq Dorierning aytishicha, hujumchi BTCPay Serverning 2.4.2 dan oldingi versiyalaridagi zaifliklardan foydalanganiga ishoralar bor edi, bu loyihani keyinchalik tasdiqladi.
"Bizning hodisa javob tekshiruvimiz 2.4.1 (2026-yil 23-iyul) yoki undan oldingi versiyalarda ishlaydigan nusxalarni nishonga olgan hujum vektorini aniqladi," deb aytadi BTCPay Server.
"Bizda so'nggi 2.4.7 relizini ishlatayotgan foydalanuvchilar uchun hot wallet o'g'irliklari haqida ishonchli xabarlar yo'q. Biz yana barchani BTCPay Serverni yangilab turishga chaqiramiz."
Ta'sirlangan foydalanuvchilardan barcha tafsilotlar va faoliyat jurnallarini security@btcpayserver.org manziliga yuborish so'ralmoqda.
Shuni ta'kidlash joizki, 7-avgustda BTCPay Server 2.4.2 versiyasini chiqarar ekan, u LND ma'lumot fayllarini ochib qo'yadigan va hujumchilarga ta'sirlangan Lightning tugunlarini nazorat qilish va mablag'larni o'g'irlash imkonini beradigan faol ekspluatatsiya qilinayotgan kamchilik haqida ogohlantirgan edi.
Loyiha so'nggi hujumlarda qaysi kamchilik ekspluatatsiya qilinayotganini aniqlamagan.
BleepingComputer BTCPay Server bilan hozirgi hujumlarda ekspluatatsiya qilinayotgan zaiflik haqida ko'proq ma'lumot olish uchun bog'langan, ammo nashr vaqti bo'yicha javob olmagan.
Ta'sirlangan foydalanuvchilar Server Settings → Maintenance → Update orqali 2.4.7 versiyasiga yangilanishlari kerak.
Docker o'rnatishlari uchun administratorlar SSH orqali kirib, sudo su - buyrug'ini bajarib, cd btcpayserver-docker bilan joylashuv katalogiga o'tib va ./btcpay-update.sh skriptini ishga tushirib BTCPay Serverni yangilashlari mumkin.
Agar 2.4.1 yoki undan oldingi versiyada ishlayotgan bo'lsangiz, nusxani iloji boricha tezroq oflayn rejimga o'tkazish tavsiya etiladi.
Mavjud himoyalaringiz o'tkazib yuborishi mumkin bo'lgan elektron pochta tahdidlarini aniqlang.
Adaptive Security'ning AI agentlari elektron pochta niyati, konteksti va xatti-harakatini tahlil qilib, fishing, biznes elektron pochta buzilishi va hisob-faktura firibgarligini aniqlaydi.
Microsoft 365 yoki Google Workspace'ning 14 kunlik faqat o'qish skaneri bilan MX o'zgarishlarsiz nima o'tib ketayotganini ko'ring.
Bepul elektron pochta xavfsizligi skaneringizni boshlang.
The maintainer of BTCPay Server, an open-source cryptocurrency payment processor, has urged users to install the latest version as hackers have been draining “hot wallets” on instances running older versions.
Operators were initially advised to shut down their servers pending a full investigation into the unauthorized payments.
The BTCPay Server project provides businesses with a self-hosted payment processing solution that allows them to accept Bitcoin and other digital assets directly into their own wallets, eliminating payment intermediaries or paying platform processing fees.
It handles checkout invoices and payment verification, including payments over the Lightning Network.
Early Monday, the maintainer said it had “identified an attack vector targeting instances running version 2.4.1 (July 23, 2026) or earlier” and strongly urged users to update to version 2.4.7.
BTCPay founder Nicolas Dorier said the attacks did not target public servers. The investigation focused on determining how the threat actor was able to log in as an administrator to instances running versions older than 2.4.2.
On October 29, the company disclosed a critical vulnerability discovered via Anthropic’s Frontier OSS scanner, which prompted the release of version 2.4.7 as an emergency security update.
However, Dorier said that there were clues that the attacker used vulnerabilities in BTCPay Server versions earlier than 2.4.2, which the project later confirmed.
“Our incident response investigation identified an attack vector targeting instances running versions 2.4.1 (Jul 23, 2026) or older,” BTCPay Server says.
“We have no credible reports of hot wallet drains for users running the latest 2.4.7 release. We again urge everyone to keep their BTCPay Server updated.”
Impacted users are requested to send all details and activity logs to security@btcpayserver.org.
It is worth noting that on August 7, when BTCPay Server released version 2.4.2, it warned about an actively exploited flaw exposing LND credential files that allowed attackers to control affected Lightning nodes and steal funds.
The project has not clarified what flaw is being exploited in the recent attacks.
BleepingComputer has contacted BTCPay Server for more details about the vulnerability exploited in the current attacks, but we have not received a response by publication time.
Impacted users should update to version 2.4.7 through Server Settings → Maintenance → Update.
For Docker installations, administrators can update BTCPay Server by logging in over SSH, running sudo su -, changing to the deployment directory with cd btcpayserver-docker, and executing ./btcpay-update.sh.
If running 2.4.1 or older, it is recommended to take the instance offline as soon as possible.
Uncover email threats your existing defenses may miss.
Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
Start your free email security scan.