BTCPay Server — o'z-o'zini joylashtiradigan, ochiq kodli kriptovalyuta to'lov protsessori — foydalanuvchilardan dasturiy ta'minotning so'nggi versiyasini o'rnatishni so'radi, chunki eski versiyalarda ishlaydigan serverlarda Bitcoin va Litecoin issiq hamyonlardan o'g'irlanganligi haqida xabarlar tarqaldi.
"Bizning tekshiruvimiz shuni ko'rsatdiki, bu hujumlar BTCPay Server 2.4.1 (2026-yil 23-iyulda chiqarilgan) yoki undan oldingi versiyalarda ishlaydigan serverlarga qaratilgan", — dedi BTCPay Server. "Hujumchilar 2026-yil 7-avgustda chiqarilgan 2.4.2 versiyasida tuzatilgan zaiflikni boshqa usul bilan ekspluatatsiya qilishgan."
2.4.1 yoki undan oldingi versiyalarni ishlatayotgan foydalanuvchilarga, hatto o'g'irlik sezilmagan hollarda ham, yangi serverga yangi hamyon bilan ko'chish tavsiya etiladi. Mablag'lar o'g'irlangan yoki ruxsatsiz kirish shubha qilingan taqdirda, foydalanuvchilar butun mashina va unda saqlanadigan barcha maxfiy ma'lumotlarni buzilgan deb hisoblashlari va shu tiklanish tartib-qoidalariga amal qilishlari shart.
Hujumchilar kampaniyani qachon boshlagani hozircha noma'lum, garchi xabarlar 2026-yil 1-noyabr atrofida tarqala boshlagan bo'lsa-da.
X'dagi postida BTCPay Server so'nggi 2.4.7 versiyasini ishlatayotgan foydalanuvchilardan issiq hamyon bo'shatilishi haqida "ishonchli xabarlar" kelmaganini aytdi. Bu versiya Anthropic'ning OSS skaneri orqali aniqlangan bitta tanqidiy va bir nechta o'rta darajadagi xavfsizlik zaifliklarini tuzatadi.
BTCPay Server shuningdek, ushbu hodisalar bilan bog'liq ikkita hamyon manzilini ham ulashdi —
- Bitcoin: bc1p0f7wmcnesrapznymf9ljdn04pudgmh96sqtrm9vmgqxdh666fh8qvn63r7
- Litecoin: ltc1qp49tmfdueyaqrmgrx0uyx4uegyygt8yt02whee
"Agar sizga kundalik operatsiyalar uchun issiq hamyon kerak bo'lsa, serverda faqat shu operatsiyalar uchun zarur mablag'larni saqlang va qolganini sarflash kalitlari serverdan tashqarida saqlanadigan hamyonga ko'chiring", — deb ogohlantirdi u.
"Agar siz BTCPay Serverni hosting provayderi orqali ishlatsangiz, sizning nusxangiz eski versiyalar ekspluatatsiya qilinishining oldini olish uchun avtomatik ravishda o'chirilgan bo'lishi mumkin."
2026-yil avgustda BTCPay Server tanqidiy zaiflik hujumchilar tomonidan foydalanuvchilardan mablag' o'g'irlash uchun qurollanganini ma'lum qilgan edi. Barcha BTCPay Server versiyalariga ta'sir qiladigan muammo 2.4.2 versiyasida tuzatilgan. So'nggi hujumlar to'plami xuddi shu zaiflik bilan bog'liqmi yoki yo'qmi, noma'lum.
"Muammo autentifikatsiya qilinmagan masofaviy hujumchiga LND — Lightning Network amalga oshirishining .macaroon hisob ma'lumot fayllarini olish imkonini berishi mumkin", — deb aytildi avgustdagi ogohlantirishda. "Ushbu hisob ma'lumotlari LND tugunini nazorat qilish va mablag'larni ko'chirish uchun ishlatilishi mumkin. Biz ko'rib chiqqan hujumlar faqat .macaroon kengaytmasiga ega fayllarni nishonga olgan."
Bu voqea kriptovalyuta sohasidagi xavfsizlik buzilishlari va ekspluatatsiyalar qatoriga to'g'ri keladi, jumladan, Shimoliy Koreya tahdid aktorlari tomonidan Binance'dan 6,43 milliard dollar o'g'irlanishi — bu rekord o'g'irlik. O'sha kuni bashorat bozori giganti Polymarket DebugBear tomonidan ishlab chiqilgan dasturiy ta'minot buzilgandan so'ng 2,65 million dollarlik ekspluatatsiyaga uchraganidan keyin savdoni qisqa muddatga to'xtatdi.
Apparat hamyon ishlab chiqaruvchisi Trezor ham ogohlantirish bilan chiqdi: u 2026-yil avgustda CryptoBilis'dan sotib olingan Trezor Safe 5 qurilmasida apparat implant borligi haqidagi mas'uliyatli oshkor qilish hisobotini olganini aytdi. Bu uchinchi tomon qayta sotuvchilar orqali sotilgan ba'zi qurilmalarning jismoniy ravishda buzilib, jabrlanuvchining urug' iborasini o'g'irlash va aktivlarni bo'shatish uchun ishlatilishi bilan bog'liq murakkab ta'minot zanjiri hujumi qismi deb baholanmoqda.
Mercado Bitcoin Xavfsizlik Hodisasini Oshkor Qildi
Dushanba kuni Braziliyaning eng yirik kriptovalyuta birjasi Mercado Bitcoin xavfsizlik buzilishi natijasida 49 million dollar mablag' o'g'irlanganidan so'ng depozit va yechib olish operatsiyalarini vaqtincha to'xtatayotganini aytdi.
"Hozirgi paytda jalb qilingan aktivlar qiymati taxminan 38 million dollarni tashkil etadi", — deb aytildi X'dagi postida. "Kripto hamjamiyati va strategik hamkorlar — jumladan Tether, Circle, Paxos, BRL1 va Chainalysis — bilan tezkor harakat natijasida biz allaqachon 11 million dollar USDT'ni blokladik."
"Bloklashga mos keladigan boshqa summalar aniqlangan va cheklash harakatlari davom etmoqda. Xizmatlar to'liq xavfsizlik sharoitlari ta'minlangandan so'ng qayta tiklanadi va muddatlar faqat rasmiy kanallarimiz orqali e'lon qilinadi."
Tether bosh direktori Paolo Ardoino hodisa bilan bog'liq ravishda 4,5 milliondan ortiq USDT muzlatilganini tasdiqladi.
Ushbu maqola sizga qiziqarli tuyuldimi? Biz e'lon qiladigan eksklyuziv kontentni o'qish uchun bizni Google News, Twitter va LinkedIn'da kuzating.
BTCPay Server, a self-hosted, open-source cryptocurrency payment processor, has urged users to install the latest version of its software in response to reports of Bitcoin and Litecoin being stolen from hot wallets on instances running older versions.
"Our investigation found that these attacks targeted servers running BTCPay Server 2.4.1 (released on 23 July 2026) or earlier," BTCPay Server said. "The attackers used a different method to exploit the vulnerability fixed in 2.4.2, released on 7 August 2026."
Users who are running versions 2.4.1 or earlier are recommended to move to a fresh server with a new wallet, even in scenarios where users have not noticed a theft. In the event of stolen funds or suspected unauthorized access, it's imperative that users consider the entire machine and all secrets stored on it as compromised and follow the same recovery procedures.
It's currently unknown when the attackers behind the campaign first began exploiting the vulnerability, although reports began to surface around November 1, 2026.
In a post on X, BTCPay Server said no "credible reports" of hot wallet drains have been reported from users running the latest 2.4.7 release. The version addresses one critical and several medium-severity security vulnerabilities discovered via Anthropic's OSS scanner.
BTCPay Server has also shared two wallet addresses linked to these incidents -
- Bitcoin: bc1p0f7wmcnesrapznymf9ljdn04pudgmh96sqtrm9vmgqxdh666fh8qvn63r7
- Litecoin: ltc1qp49tmfdueyaqrmgrx0uyx4uegyygt8yt02whee
"If you need a hot wallet for daily operations, keep only the funds needed for those operations on the server and move the rest to a wallet whose spending keys are held off the server," it cautioned.
"If you run BTCPay Server through a hosting provider, your instance may have been shut down automatically to keep older versions from being exploited."
In August 2026, BTCPay Server disclosed that a critical vulnerability had been weaponized by attackers to steal funds from some users. The issue, which affects all BTCPay Server versions, was patched in version 2.4.2. It's unclear if the latest set of attacks is related to the same vulnerability.
"The issue could allow an unauthenticated remote attacker to obtain .macaroon credential files for LND, an implementation of the Lightning Network," it said in the August alert. "Those credentials could be used to take control of an LND node and move funds. The attacks we reviewed targeted only files with the .macaroon extension."
The development coincides with a string of security breaches and exploits across the cryptocurrency space, including the record theft of $6.43 billion from Binance by North Korean threat actors. That same day, prediction market giant Polymarket briefly halted trading after it was hit by a $2.65 million exploit following the compromise of software developed by DebugBear.
Hardware wallet maker Trezor also followed suit with a warning that it received a responsible disclosure report alleging a hardware implant in a Trezor Safe 5 purchased from CryptoBilis in August 2026. It's assessed to be part of a sophisticated supply chain attack in which some of the devices sold via third-party resellers are physically tampered with to steal the victim's seed phrase and use it to drain assets.
Mercado Bitcoin Discloses Security Incident
On Monday, Mercado Bitcoin, Brazil's largest cryptocurrency exchange, said it's temporarily pausing deposits and withdrawals following a security breach that resulted in $49 million in stolen funds..
"At this moment, the value of the assets involved is approximately $ 38 million," it said in a post on X. "In a swift action with the crypto community and strategic partners – including Tether, Circle, Paxos, BRL1, and Chainalysis – we have already blocked US$ 11 million."
"Other amounts eligible for blocking have been identified, and containment efforts continue. The resumption of services will occur as soon as full security conditions are met, and deadlines will be communicated exclusively through our official channels."
Tether CEO Paolo Ardoino confirmed that the stablecoin issuer had frozen more than 4.5 million USDT in connection with the incident.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
