[Legacy Vulnerability Leads to Hot Wallet Theft; BTCPay Server Recommends Immediate Migration] Odaily Planet Daily reports that the open-source Bitcoin payment processing tool BTCPay Server received multiple reports on November 1st of unauthorized theft of funds from its Bitcoin and Litecoin hot wallets. On November 2nd, the project team released an update confirming the attack targeted servers running BTCPay Server version 2.4.1 or earlier. Attackers exploited a vulnerability patched in version 2.4.2 on August 7th, gaining server administrator privileges and emptying hot wallet funds through various methods. BTCPay Server founder Nicolas Dorier confirmed that only servers running versions prior to 2.4.2, especially 2.4.1, were affected; no credible reports of losses have been received from users running the latest version 2.4.7. Some affected service providers, including LunaNode, have automatically shut down potentially vulnerable older instances. The official recommendation is for users still using version 2.4.1 or earlier to immediately transfer any remaining funds in their old hot wallet to a new wallet created with a new mnemonic phrase, take the old server offline and retain all relevant logs, then install the latest version on a new virtual machine and connect the new wallet. Do not restore the entire old server to the new machine. Simply updating the software version is insufficient to eliminate the risk, as attackers may have already gained persistent access to the old server. Funds held outside the server, such as those in hardware wallets, are unaffected by this incident. This vulnerability is related to a vulnerability patched in August of this year, in which attackers manipulated nodes by obtaining LND management credentials. As of now, this vulnerability has not been assigned a CVE number and is not listed in the CISA known exploited vulnerability directory.