Samson Mow
@Excellion
For anyone using SamRock with
@BtcpayServer, you’re likely safe from the current attacks. Hot on-chain wallets generated in BTCPay are at risk, and SamRock deliberately avoids creating those. Lightning nodes connected to BTCPay are also being drained, and again SamRock precludes that. An attacker who takes over your BTCPay instance via the 2FA-bypass cannot drain the funds sitting in your
@AquaBitcoin wallet. You should still update to 2.4.2 and follow the macaroon/auth refresh steps if you have any Lightning components in addition to SamRock. Note that while Boltz is down, SamRock will not be able to process swaps. The
@JAN3com team has started to work on a solution and will continue working through the weekend.
@BtcpayServer, you’re likely safe from the current attacks. Hot on-chain wallets generated in BTCPay are at risk, and SamRock deliberately avoids creating those. Lightning nodes connected to BTCPay are also being drained, and again SamRock precludes that. An attacker who takes over your BTCPay instance via the 2FA-bypass cannot drain the funds sitting in your
@AquaBitcoin wallet. You should still update to 2.4.2 and follow the macaroon/auth refresh steps if you have any Lightning components in addition to SamRock. Note that while Boltz is down, SamRock will not be able to process swaps. The
@JAN3com team has started to work on a solution and will continue working through the weekend.
@BtcpayServer
There is a critical vulnerability being actively exploited on BTCPay Server, which can result in the loss of funds.
Please update your BTCPayServer to 2.4.2 by going to Admin Dashboard -> Server -> Maintenance -> Update & verify the 2.4.2 version string in the footer.
If you are unable to update right away, turn off your BTCPay Server to prevent unauthorized access until you can update.