Open-source Bitcoin payment processor BTCPay has issued an urgent advisory to merchants, urging them to replace wallet credentials after hackers stole an estimated $1.6 million from user hot wallets. The November 2 update from the project links the thefts to a vulnerability that was patched in August, but warns that simply updating software cannot remove access already gained by attackers.
The critical distinction in BTCPay's guidance centers on the nature of the exploited flaw. While the vulnerability received a patch in August, merchants who had not yet updated remained exposed, and those who did update after compromise may still have active attacker access to their wallets. The recommendation to replace wallets entirely rather than rely on patching reflects the severity of the intrusion and the limitations of reactive security measures in cryptocurrency infrastructure.
The BTCPay incident represents a smaller-scale but operationally significant breach in a week marked by larger security developments. Blockchain investigator ZachXBT has identified additional funds flowing from a suspected European theft, with the estimated total now reaching $133 million. The investigator flagged another $27 million in exchange withdrawals, some occurring after initial public disclosure of the suspected theft, suggesting ongoing movement of stolen assets despite awareness efforts.
The largest security story of the period involves conflicting narratives around a record-breaking exchange breach. North Korea has formally denied FBI attribution of the $6.3 billion Binance hack, with Kim Yo Jong characterizing US allegations as politically motivated. The rejection from Pyongyang comes after the FBI publicly identified North Korean hackers as responsible for what stands as the largest cryptocurrency exchange theft on record.
The denial from Kim Jong Un's sister marks a notable departure from typical state silence regarding cyber operations attribution. Rather than ignoring the FBI's claims, North Korea has opted for direct confrontation of the allegations, redirecting scrutiny toward the United States. This rhetorical strategy aligns with broader patterns of official North Korean communications that frame external accusations as elements of hostile policy rather than factual determinations.
The scale differential between the BTCPay and Binance incidents illustrates the range of threat vectors currently active in cryptocurrency security. While nation-state actors pursue nine-figure exchange breaches, infrastructure-level vulnerabilities in widely deployed open-source software enable substantial losses through more accessible attack paths. The BTCPay advisory specifically addresses merchants who may lack dedicated security resources, emphasizing that patching alone proves insufficient when credentials have been exfiltrated.
The temporal proximity of these disclosures—hot on the heels of ZachXBT's ongoing European theft investigation—contributes to an unusually concentrated period of security-focused reporting. The $133 million figure attributed to the European incident, combined with the $1.6 million BTCPay losses and the $6.3 billion Binance attribution dispute, collectively demonstrate both the diversity of attack methodologies and the challenges of definitive attribution in cryptocurrency security incidents. Kim Yo Jong's rejection of FBI findings ensures that questions of provenance for the Binance hack will remain contested regardless of technical evidence presented by investigators.