Summary
- BTCPay Server has reported that a significant security flaw is being actively exploited by attackers.
- Users are advised to update their systems immediately or deactivate their servers.
- The organization has not confirmed the involvement of AI in these attacks.
On Friday, BTCPay Server issued a warning to its users regarding an active exploitation of a critical vulnerability that poses a risk of fund theft.
In a message shared on X, the Bitcoin payment service provider urged server administrators to upgrade to version 2.4.2 and verify the update in the server footer.
“If you cannot update immediately, please disable your BTCPay Server to prevent unauthorized access until you can perform the update,” the company advised.
Additionally, BTCPay Server instructed users to change their macaroons credentials, recreate the macaroons.db file, and refresh the authentication strings for other Lightning Network backends.
“If you created a hot on-chain wallet within BTCPay, you should transfer those funds and set up a new wallet,” they noted.
The vulnerability was reported by members of the Bitcoin Red Team, for which BTCPay Server expressed gratitude.
However, the project has not provided details on the flaw's mechanics, the onset of the attacks, the number of affected servers, or whether any funds have been misappropriated.
While BTCPay Server did not clarify if AI was involved, the announcement coincides with a rise in AI's role in identifying vulnerabilities within crypto projects.
In May, security researcher Taylor Hornby utilized Anthropic’s Claude Opus 4.8 to discover a four-year-old vulnerability in Zcash that could have allowed the creation of unlimited counterfeit ZEC.
In August, Coinkite, the maker of Coldcard, suggested that attackers might have employed AI to exploit a firmware flaw responsible for over $100 million in Bitcoin theft.
More recently, on Tuesday, Boltz, a Bitcoin swap provider, suspended its operations following several exploits, citing that AI-assisted attacks were uncovering vulnerabilities more rapidly than their team could address them.
BTCPay Server has yet to respond to a request for comments from Decrypt.