Sadly, itโs not posted on the @npub155m2...dcvg Nostr profile, but if you still run an instance, stop. Immediately. ๐
Login to reply
Replies (16)
again? lol
what the fuck
Worth noting it's different from August. That one drained Lightning nodes through leaked LND credentials, and the hot wallets were fine. This time it's the hot wallets, three days after 2.4.7 fixed 85 security issues. No word yet on which versions are hit, so down it goes.
shit, no wonder no one is taking Lightning at El Zonte or Bitcoin Beach!
Gotta get the red team on this repo
They have bigger fish to fry.
Thanks for the heads up! ๐๐ผ๐๐ผ
Thanks!
Jesus christ.
Red team training LLMs on how to exploit further
Update on BTCPay: Nicolas Dorier says the hit servers ran versions older than 2.4.2, and the attacker logged in as an admin there, how is still unknown. Their own servers on 2.4.7 weren't touched. No loss figures. The advice is still to keep it off until they finish, and update before turning it back on.
https://www.coindesk.com/tech/2026/11/02/btcpay-a-bitcoin-payment-tool-tells-users-to-switch-off-their-servers-after-reports-of-drained-wallets
Sadly, itโs not broadcasted by @npub155m2...dcvg developer @Pavlenex on the open protocol of communication and information, nostr, but hereโs more information about the vulnerability ๐๐ป
View quoted note โ
View quoted note โ
View quoted note โ
View quoted note โ
๐๐ป
View quoted note โ
They havenโt posted on Nostr in almost a year
No point in tagging Twitter clowns
๐คก
They wonโt even get the notification
Follow-up: BTCPay now says the attack vector hits 2.4.1 and older, and they have no credible reports of drains on 2.4.7. So the advice changed: update to 2.4.7, and only old instances should go offline right away. Still no word on how the admin logins happened.