Blockchain analytics firm Bitquery estimates that attackers took about $1.63 million in Bitcoin and Litecoin from BTCPay Server hot wallets across 682 transactions between October 30 and November 2, adding a quantified loss estimate to the theft reports that prompted the self-hosted payment project to issue a shutdown warning.
In its November 2 on-chain investigation, Bitquery traced 18.38 BTC and 3,405 LTC to two addresses published by BTCPay Server’s founder.
The analysis says 87% of the traced value moved in a wave between 14:12 and 22:16 UTC on November 1. It counted another 267 sweeps worth about $150,000 after BTCPay’s shutdown alert at 22:25 UTC that day. The tally runs through 06:00 UTC on November 2; at that cutoff, more than 99% of the traced funds remained in addresses first used in the theft, and Bitquery had not identified funds reaching a known exchange.
BTCPay said on November 2 that the identified attack vector targeted versions 2.4.1, released July 23, or older, and that it had no credible reports of hot-wallet drains on the latest 2.4.7 release. Founder Nicolas Dorier said attackers logged in as administrators on affected instances, while the route to that access remains under investigation. The project had initially asked all operators to shut down while it investigated, as reported in Abijita’s coverage of the initial warning. Its November 2 update narrowed the version range.
Bitquery cautioned that its figure is a floor: it follows the two addresses named by BTCPay and one additional wallet it associated with the thief, but does not include other addresses, Lightning transfers or other coins. BTCPay has not disclosed an official loss total or the number of affected servers.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
