BTCPay Server has tightened its advice after Sunday's hot-wallet thefts. In a security advisory posted Monday, the project said attackers "used a different method to exploit the vulnerability fixed in 2.4.2," a release from Aug. 7. Servers running 2.4.1 or earlier were the targets.

The bigger change is what operators should do. On Sunday the message was to shut down and update. Now BTCPay says updating "cannot remove access an attacker may already have gained." Anyone who ran 2.4.1 or earlier should move to a fresh server with a new wallet. That applies even with no sign of theft, and even if they updated after the Nov. 1 warning.

The steps, per the advisory: sweep remaining hot-wallet funds to a new wallet made on a trusted device with a new seed. Take the old server offline and save logs. Install the latest release on a new virtual machine, and don't restore the old server onto it. Then replace hosting, SSH, API and Lightning credentials from a trusted device. Servers already on 2.4.2 or later when the warning went out saw no impact, BTCPay says, and wallets with keys held off the server, including hardware wallets, were unaffected.

The project's timeline puts a drain at 7:46 a.m. CT on Nov. 1 and the first theft report at 2:56 p.m. CT. It said activity at the two published destination addresses predates the thefts, so their balances aren't a loss total. It also admitted, "We wish we had done more to reach users still running older versions."

For your own holdings: never store seed phrases or private keys in a password manager or on any electronic device. Keep them offline on paper or metal, and use strong caution if anything is ever stored digitally. See our hot vs. cold wallet guide.