According to CoinMeta, the BTCPay server has been under attack by hackers since October 30th, with attackers extracting funds from hot wallets installed on the self-hosted BTCPay servers. The BTCPay project has identified losses related to version 2.4.1 and earlier versions; blockchain data company Bitquery estimates that approximately $1.63 million in Bitcoin and Litecoin has flowed out of merchant wallets. BTCPay issued a warning on November 1st, requesting all operators to shut down their servers to locate the point of intrusion. By November 2nd, the team had linked the attack to installations of version 2.4.1 and earlier versions released on July 23rd, during which hackers obtained administrator-level access. BTCPay currently recommends that operators update to version 2.4.7 before restarting their servers, and also asks them to retain logs and report the incident.