{"id":562107,"date":"2026-09-13T19:30:17","date_gmt":"2026-09-13T18:30:17","guid":{"rendered":"https:\/\/cryptoslate.com\/?p=562107"},"modified":"2026-09-13T16:04:04","modified_gmt":"2026-09-13T15:04:04","slug":"malicious-bots-are-actively-probing-exposed-bitcoin-payment-servers-to-steal-master-administrative-keys","status":"publish","type":"post","link":"https:\/\/cryptoslate.com\/malicious-bots-are-actively-probing-exposed-bitcoin-payment-servers-to-steal-master-administrative-keys\/","title":{"rendered":"Malicious bots are actively probing exposed Bitcoin payment servers to steal master administrative keys"},"content":{"rendered":"<p><a href=\"https:\/\/cryptoslate.com\/coins\/bitcoin\/\">Bitcoin<\/a> payment processor BTCPay Server has <a href=\"https:\/\/blog.btcpayserver.org\/btcpay-server-2-4-4\/\">warned<\/a> that bots are probing exposed <a href=\"https:\/\/cryptoslate.com\/why-lightning-network-capacity-declining-20-in-2025-is-not-as-bad-as-it-sounds\/\">Lightning nodes<\/a> for a potential route to administrative control.<\/p>\n<p>The activity follows a separate critical BTCPay vulnerability that attackers exploited a month ago to obtain credentials protecting LND nodes and drain merchant wallets.<\/p>\n<p>BTCPay subsequently disabled external access to <a href=\"https:\/\/cryptoslate.com\/old-lightning-nodes-may-be-exposed-to-a-full-channel-wipeout-after-lnd-fix-lands-later-than-disclosed\/\">LND, a widely used implementation of Bitcoin\u2019s Lightning Network,<\/a> in its standard Docker deployment. The project now says automated systems are targeting servers where operators manually restored that access, repeatedly calling an LND password-change endpoint.<\/p>\n\n<div class=\"cs-article-embed\">\n    <a href=\"https:\/\/cryptoslate.com\/bitcoin-core-lightning-docker-bug-leaves-node-operators-exposed-despite-showing-updated-version\/\" class=\"cs-article-embed__link\">\n        <div class=\"cs-article-embed__body\">\n            <span class=\"cs-article-embed__related-reading\">Related Reading<\/span>\n            <h3 class=\"cs-article-embed__title\">Bitcoin Core Lightning Docker bug leaves node operators exposed despite showing updated version<\/h3>\n        <\/div>\n        <span class=\"cs-article-embed__arrow\" aria-hidden=\"true\">\n            <i class=\"fa-light fa-arrow-up-right\"><\/i>\n        <\/span>\n    <\/a>\n<\/div>\n\n<p>The latest mechanism differs from the vulnerability exploited in August but could lead to a similar outcome: an attacker obtaining credentials that can control an LND node.<\/p>\n<p>BTCPay said the opening appears during a short interval after LND restarts, while its wallet remains locked. During that period, the targeted password-change method does not require a macaroon, the credential LND normally uses to authorize administrative actions.<\/p>\n<p>Older BTCPay LND wallets compounded the risk by using a shared default password. An attacker who could reach the interface before BTCPay\u2019s internal unlocker could potentially submit that password first, replace it, and request an administrator macaroon that gives control over the node.<\/p>\n<p>BTCPay has not reported a successful takeover through the newly observed activity or linked the bots to the attackers behind the August thefts.<\/p>\n<h2>BTCPay hardens nodes after August theft<\/h2>\n<p>The renewed probing extends a difficult security stretch for BTCPay, which acknowledged on Aug. 7 that attackers had exploited a vulnerability affecting all versions before 2.4.2. That flaw allowed unauthenticated attackers to obtain LND macaroon files and use them to move funds. BTCPay\u2019s standard on-chain wallets were unaffected.<\/p>\n<p>Days later, the project and its supporters <a href=\"https:\/\/blog.btcpayserver.org\/btcpay-server-security-incident-response-and-next-steps\/\">offered<\/a> a bounty equal to 10% of recovered bitcoin, capped at 3 BTC, then worth about $190,000. BTCPay also enlisted exchanges, blockchain analytics firms, and law enforcement in efforts to trace the stolen funds.<\/p>\n<p>Version 2.4.4, <a href=\"https:\/\/github.com\/btcpayserver\/btcpayserver\/releases\/tag\/v2.4.4\">released<\/a> Sept. 7, now addresses the conditions behind the latest attack path. New LND wallets receive unique random passwords, while older installations using the shared credential are migrated and have their passwords rotated.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter wp-image-562110\" src=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-aa1bee67-0172-45e1-80ff-bf4e25aa8237.png\" alt=\"Diagram showing the manually exposed LND restart window and the password and proxy protections in BTCPay Server 2.4.4.\" width=\"720\" height=\"405\" srcset=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-aa1bee67-0172-45e1-80ff-bf4e25aa8237.png 1672w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-aa1bee67-0172-45e1-80ff-bf4e25aa8237-300x169.png 300w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-aa1bee67-0172-45e1-80ff-bf4e25aa8237-1024x576.png 1024w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-aa1bee67-0172-45e1-80ff-bf4e25aa8237-768x432.png 768w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-aa1bee67-0172-45e1-80ff-bf4e25aa8237-1536x864.png 1536w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-aa1bee67-0172-45e1-80ff-bf4e25aa8237-480x270.png 480w, https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/exec-aa1bee67-0172-45e1-80ff-bf4e25aa8237-1200x675.png 1200w\" sizes=\"(max-width: 720px) 100vw, 720px\" \/><\/p>\n<p>BTCPay\u2019s standard reverse proxy also blocks unauthenticated wallet setup and unlock methods, closing the restart-time opening through its managed public network path.<\/p>\n<p>Those controls cannot secure infrastructure operators configure independently. Administrators who created their own reverse proxy or otherwise exposed LND publicly can still bypass BTCPay\u2019s protections.<\/p>\n<p>BTCPay has urged administrators to install version 2.4.4 and remove manually exposed LND routes. A route-control change merged Sept. 11 provides a supported option for remote access while keeping LND and Core Lightning interfaces disabled by default.<\/p>\n<p>That leaves custom deployments as the immediate concern. Operators using them must audit their proxy rules and migrate remote connections behind BTCPay\u2019s managed controls while automated systems continue searching for reachable nodes.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The risk is limited to manually exposed APIs, and version 2.4.4 closes the standard public path.<\/p>\n","protected":false},"author":720,"featured_media":562272,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[77968,60208,37],"tags":[81073,77433],"prediction_market_topic":[],"post_folder":[],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v21.9 (Yoast SEO v21.9.1) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Bots are probing Bitcoin Lightning nodes for a takeover route<\/title>\n<meta name=\"description\" content=\"BTCPay Server says automated probes are now targeting a password-change route that could expose administrator credentials.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptoslate.com\/malicious-bots-are-actively-probing-exposed-bitcoin-payment-servers-to-steal-master-administrative-keys\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Malicious bots are actively probing exposed Bitcoin payment servers to steal master administrative keys\" \/>\n<meta property=\"og:description\" content=\"BTCPay Server says automated probes are now targeting a password-change route that could expose administrator credentials.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptoslate.com\/malicious-bots-are-actively-probing-exposed-bitcoin-payment-servers-to-steal-master-administrative-keys\/\" \/>\n<meta property=\"og:site_name\" content=\"CryptoSlate\" \/>\n<meta property=\"article:published_time\" content=\"2026-09-13T18:30:17+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-09-13T15:04:04+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/btcpay-node-swarm.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Oluwapelumi Adejumo\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@cryptoslate\" \/>\n<meta name=\"twitter:site\" content=\"@cryptoslate\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Oluwapelumi Adejumo\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"NewsArticle\",\"@id\":\"https:\/\/cryptoslate.com\/malicious-bots-are-actively-probing-exposed-bitcoin-payment-servers-to-steal-master-administrative-keys\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/cryptoslate.com\/malicious-bots-are-actively-probing-exposed-bitcoin-payment-servers-to-steal-master-administrative-keys\/\"},\"author\":{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptoslate.com\/author\/oluwapelumi-adejumo\/#person\",\"name\":\"Oluwapelumi Adejumo\",\"url\":\"https:\/\/cryptoslate.com\/author\/oluwapelumi-adejumo\/\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/cryptoslate.com\/author\/oluwapelumi-adejumo\/\"},\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\/\/cryptoslate.com\/author\/oluwapelumi-adejumo\/#authorimage\",\"url\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2025\/12\/profile-photo-oluwapelumi-adejumo-300x300.jpg\",\"contentUrl\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2025\/12\/profile-photo-oluwapelumi-adejumo-300x300.jpg\",\"caption\":\"Oluwapelumi Adejumo\"},\"jobTitle\":\"Senior Reporter\",\"description\":\"Oluwapelumi values Bitcoin's potential. He imparts insights on a range of topics like DeFi, hacks, mining and culture, underlining transformative power.\",\"worksFor\":{\"@id\":\"https:\/\/cryptoslate.com\/#organization\"},\"sameAs\":[\"https:\/\/x.com\/hardeyjumoh\",\"https:\/\/www.linkedin.com\/in\/oluwapelumi-adejumo\",\"https:\/\/muckrack.com\/oluwapelumi-adejumo\"]},\"headline\":\"Malicious bots are actively probing exposed Bitcoin payment servers to steal master administrative keys\",\"datePublished\":\"2026-09-13T18:30:17+00:00\",\"dateModified\":\"2026-09-13T18:30:17+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/cryptoslate.com\/malicious-bots-are-actively-probing-exposed-bitcoin-payment-servers-to-steal-master-administrative-keys\/\"},\"wordCount\":482,\"publisher\":{\"@id\":\"https:\/\/cryptoslate.com\/#organization\"},\"keywords\":[\"Bitcoin\",\"payments\"],\"articleSection\":[\"Featured\",\"Payments\",\"Technology\"],\"inLanguage\":\"en-US\",\"copyrightYear\":\"2026\",\"copyrightHolder\":{\"@id\":\"https:\/\/cryptoslate.com\/#organization\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/cryptoslate.com\/malicious-bots-are-actively-probing-exposed-bitcoin-payment-servers-to-steal-master-administrative-keys\/\",\"url\":\"https:\/\/cryptoslate.com\/malicious-bots-are-actively-probing-exposed-bitcoin-payment-servers-to-steal-master-administrative-keys\/\",\"name\":\"Bots are probing Bitcoin Lightning nodes for a takeover route\",\"isPartOf\":{\"@id\":\"https:\/\/cryptoslate.com\/#website\"},\"datePublished\":\"2026-09-13T18:30:17+00:00\",\"dateModified\":\"2026-09-13T18:30:17+00:00\",\"description\":\"BTCPay Server says automated probes are now targeting a password-change route that could expose administrator credentials.\",\"breadcrumb\":{\"@id\":\"https:\/\/cryptoslate.com\/malicious-bots-are-actively-probing-exposed-bitcoin-payment-servers-to-steal-master-administrative-keys\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/cryptoslate.com\/malicious-bots-are-actively-probing-exposed-bitcoin-payment-servers-to-steal-master-administrative-keys\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/cryptoslate.com\/malicious-bots-are-actively-probing-exposed-bitcoin-payment-servers-to-steal-master-administrative-keys\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/cryptoslate.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Malicious bots are actively probing exposed Bitcoin payment servers to steal master administrative keys\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/cryptoslate.com\/#website\",\"url\":\"https:\/\/cryptoslate.com\/\",\"name\":\"CryptoSlate\",\"description\":\"Cryptocurrency News and Real-time Coin Data\",\"publisher\":{\"@id\":\"https:\/\/cryptoslate.com\/#organization\"},\"inLanguage\":\"en-US\"},{\"@type\":\"NewsMediaOrganization\",\"@id\":\"https:\/\/cryptoslate.com\/#organization\",\"name\":\"CryptoSlate\",\"url\":\"https:\/\/cryptoslate.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptoslate.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2018\/05\/c-logo.jpg\",\"contentUrl\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2018\/05\/c-logo.jpg\",\"width\":1000,\"height\":1000,\"caption\":\"CryptoSlate\"},\"image\":{\"@id\":\"https:\/\/cryptoslate.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/twitter.com\/cryptoslate\",\"https:\/\/www.instagram.com\/cryptoslate\",\"https:\/\/www.linkedin.com\/company\/cryptoslate\",\"https:\/\/www.youtube.com\/c\/cryptoslate\",\"https:\/\/cryptoslate.substack.com\",\"https:\/\/t.me\/cryptoslatenews\",\"https:\/\/www.crunchbase.com\/organization\/cryptoslate\",\"https:\/\/iq.wiki\/wiki\/cryptoslate\",\"https:\/\/news.google.com\/publications\/CAAqKggKIiRDQklTRlFnTWFoRUtEMk55ZVhCMGIzTnNZWFJsTG1OdmJTZ0FQAQ\",\"https:\/\/muckrack.com\/media-outlet\/cryptoslate\",\"https:\/\/www.tiktok.com\/@cryptoslatenews\"],\"publishingPrinciples\":\"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#editorial-principles\",\"ownershipFundingInfo\":\"https:\/\/cryptoslate.com\/disclaimers\/how-cryptoslate-makes-and-spends-money\/\",\"correctionsPolicy\":\"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#corrections-feedback\",\"ethicsPolicy\":\"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#editorial-principles\",\"foundingDate\":\"2017-08-04\",\"founder\":[{\"@type\":\"Person\",\"name\":\"Nate Whitehill\"},{\"@type\":\"Person\",\"name\":\"Matthew Blancarte\"}],\"contactPoint\":[{\"@type\":\"ContactPoint\",\"contactType\":\"customer support\",\"url\":\"https:\/\/cryptoslate.com\/contact\/\",\"availableLanguage\":\"en-US\"},{\"@type\":\"ContactPoint\",\"contactType\":\"sales\",\"url\":\"https:\/\/cryptoslate.com\/advertising\/\",\"availableLanguage\":\"en-US\"},{\"@type\":\"ContactPoint\",\"contactType\":\"newsroom\",\"url\":\"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#corrections-feedback\",\"email\":\"tips@cryptoslate.com\",\"availableLanguage\":\"en-US\"}],\"masthead\":\"https:\/\/cryptoslate.com\/about\/#masthead\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/cryptoslate.com\/#\/schema\/person\/b333928a322ba4c082e8bb2ad0f14eb6\",\"name\":\"Oluwapelumi Adejumo\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/cryptoslate.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2025\/12\/profile-photo-oluwapelumi-adejumo-150x150.jpg\",\"contentUrl\":\"https:\/\/cryptoslate.com\/wp-content\/uploads\/2025\/12\/profile-photo-oluwapelumi-adejumo-150x150.jpg\",\"caption\":\"Oluwapelumi Adejumo\"},\"description\":\"Oluwapelumi values Bitcoin's potential. He imparts insights on a range of topics like DeFi, hacks, mining and culture, underlining transformative power.\",\"jobTitle\":\"Reporter\",\"worksFor\":\"CryptoSlate\",\"url\":\"https:\/\/cryptoslate.com\/author\/oluwapelumi-adejumo\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Bots are probing Bitcoin Lightning nodes for a takeover route","description":"BTCPay Server says automated probes are now targeting a password-change route that could expose administrator credentials.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptoslate.com\/malicious-bots-are-actively-probing-exposed-bitcoin-payment-servers-to-steal-master-administrative-keys\/","og_locale":"en_US","og_type":"article","og_title":"Malicious bots are actively probing exposed Bitcoin payment servers to steal master administrative keys","og_description":"BTCPay Server says automated probes are now targeting a password-change route that could expose administrator credentials.","og_url":"https:\/\/cryptoslate.com\/malicious-bots-are-actively-probing-exposed-bitcoin-payment-servers-to-steal-master-administrative-keys\/","og_site_name":"CryptoSlate","article_published_time":"2026-09-13T18:30:17+00:00","article_modified_time":"2026-09-13T15:04:04+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2026\/09\/btcpay-node-swarm.jpg","type":"image\/jpeg"}],"author":"Oluwapelumi Adejumo","twitter_card":"summary_large_image","twitter_creator":"@cryptoslate","twitter_site":"@cryptoslate","twitter_misc":{"Written by":"Oluwapelumi Adejumo","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/cryptoslate.com\/malicious-bots-are-actively-probing-exposed-bitcoin-payment-servers-to-steal-master-administrative-keys\/#article","isPartOf":{"@id":"https:\/\/cryptoslate.com\/malicious-bots-are-actively-probing-exposed-bitcoin-payment-servers-to-steal-master-administrative-keys\/"},"author":{"@type":"Person","@id":"https:\/\/cryptoslate.com\/author\/oluwapelumi-adejumo\/#person","name":"Oluwapelumi Adejumo","url":"https:\/\/cryptoslate.com\/author\/oluwapelumi-adejumo\/","mainEntityOfPage":{"@id":"https:\/\/cryptoslate.com\/author\/oluwapelumi-adejumo\/"},"image":{"@type":"ImageObject","@id":"https:\/\/cryptoslate.com\/author\/oluwapelumi-adejumo\/#authorimage","url":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2025\/12\/profile-photo-oluwapelumi-adejumo-300x300.jpg","contentUrl":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2025\/12\/profile-photo-oluwapelumi-adejumo-300x300.jpg","caption":"Oluwapelumi Adejumo"},"jobTitle":"Senior Reporter","description":"Oluwapelumi values Bitcoin's potential. He imparts insights on a range of topics like DeFi, hacks, mining and culture, underlining transformative power.","worksFor":{"@id":"https:\/\/cryptoslate.com\/#organization"},"sameAs":["https:\/\/x.com\/hardeyjumoh","https:\/\/www.linkedin.com\/in\/oluwapelumi-adejumo","https:\/\/muckrack.com\/oluwapelumi-adejumo"]},"headline":"Malicious bots are actively probing exposed Bitcoin payment servers to steal master administrative keys","datePublished":"2026-09-13T18:30:17+00:00","dateModified":"2026-09-13T18:30:17+00:00","mainEntityOfPage":{"@id":"https:\/\/cryptoslate.com\/malicious-bots-are-actively-probing-exposed-bitcoin-payment-servers-to-steal-master-administrative-keys\/"},"wordCount":482,"publisher":{"@id":"https:\/\/cryptoslate.com\/#organization"},"keywords":["Bitcoin","payments"],"articleSection":["Featured","Payments","Technology"],"inLanguage":"en-US","copyrightYear":"2026","copyrightHolder":{"@id":"https:\/\/cryptoslate.com\/#organization"}},{"@type":"WebPage","@id":"https:\/\/cryptoslate.com\/malicious-bots-are-actively-probing-exposed-bitcoin-payment-servers-to-steal-master-administrative-keys\/","url":"https:\/\/cryptoslate.com\/malicious-bots-are-actively-probing-exposed-bitcoin-payment-servers-to-steal-master-administrative-keys\/","name":"Bots are probing Bitcoin Lightning nodes for a takeover route","isPartOf":{"@id":"https:\/\/cryptoslate.com\/#website"},"datePublished":"2026-09-13T18:30:17+00:00","dateModified":"2026-09-13T18:30:17+00:00","description":"BTCPay Server says automated probes are now targeting a password-change route that could expose administrator credentials.","breadcrumb":{"@id":"https:\/\/cryptoslate.com\/malicious-bots-are-actively-probing-exposed-bitcoin-payment-servers-to-steal-master-administrative-keys\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptoslate.com\/malicious-bots-are-actively-probing-exposed-bitcoin-payment-servers-to-steal-master-administrative-keys\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/cryptoslate.com\/malicious-bots-are-actively-probing-exposed-bitcoin-payment-servers-to-steal-master-administrative-keys\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptoslate.com\/"},{"@type":"ListItem","position":2,"name":"Malicious bots are actively probing exposed Bitcoin payment servers to steal master administrative keys"}]},{"@type":"WebSite","@id":"https:\/\/cryptoslate.com\/#website","url":"https:\/\/cryptoslate.com\/","name":"CryptoSlate","description":"Cryptocurrency News and Real-time Coin Data","publisher":{"@id":"https:\/\/cryptoslate.com\/#organization"},"inLanguage":"en-US"},{"@type":"NewsMediaOrganization","@id":"https:\/\/cryptoslate.com\/#organization","name":"CryptoSlate","url":"https:\/\/cryptoslate.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptoslate.com\/#\/schema\/logo\/image\/","url":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2018\/05\/c-logo.jpg","contentUrl":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2018\/05\/c-logo.jpg","width":1000,"height":1000,"caption":"CryptoSlate"},"image":{"@id":"https:\/\/cryptoslate.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/twitter.com\/cryptoslate","https:\/\/www.instagram.com\/cryptoslate","https:\/\/www.linkedin.com\/company\/cryptoslate","https:\/\/www.youtube.com\/c\/cryptoslate","https:\/\/cryptoslate.substack.com","https:\/\/t.me\/cryptoslatenews","https:\/\/www.crunchbase.com\/organization\/cryptoslate","https:\/\/iq.wiki\/wiki\/cryptoslate","https:\/\/news.google.com\/publications\/CAAqKggKIiRDQklTRlFnTWFoRUtEMk55ZVhCMGIzTnNZWFJsTG1OdmJTZ0FQAQ","https:\/\/muckrack.com\/media-outlet\/cryptoslate","https:\/\/www.tiktok.com\/@cryptoslatenews"],"publishingPrinciples":"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#editorial-principles","ownershipFundingInfo":"https:\/\/cryptoslate.com\/disclaimers\/how-cryptoslate-makes-and-spends-money\/","correctionsPolicy":"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#corrections-feedback","ethicsPolicy":"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#editorial-principles","foundingDate":"2017-08-04","founder":[{"@type":"Person","name":"Nate Whitehill"},{"@type":"Person","name":"Matthew Blancarte"}],"contactPoint":[{"@type":"ContactPoint","contactType":"customer support","url":"https:\/\/cryptoslate.com\/contact\/","availableLanguage":"en-US"},{"@type":"ContactPoint","contactType":"sales","url":"https:\/\/cryptoslate.com\/advertising\/","availableLanguage":"en-US"},{"@type":"ContactPoint","contactType":"newsroom","url":"https:\/\/cryptoslate.com\/disclaimers\/editorial-policy\/#corrections-feedback","email":"tips@cryptoslate.com","availableLanguage":"en-US"}],"masthead":"https:\/\/cryptoslate.com\/about\/#masthead"},{"@type":"Person","@id":"https:\/\/cryptoslate.com\/#\/schema\/person\/b333928a322ba4c082e8bb2ad0f14eb6","name":"Oluwapelumi Adejumo","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptoslate.com\/#\/schema\/person\/image\/","url":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2025\/12\/profile-photo-oluwapelumi-adejumo-150x150.jpg","contentUrl":"https:\/\/cryptoslate.com\/wp-content\/uploads\/2025\/12\/profile-photo-oluwapelumi-adejumo-150x150.jpg","caption":"Oluwapelumi Adejumo"},"description":"Oluwapelumi values Bitcoin's potential. He imparts insights on a range of topics like DeFi, hacks, mining and culture, underlining transformative power.","jobTitle":"Reporter","worksFor":"CryptoSlate","url":"https:\/\/cryptoslate.com\/author\/oluwapelumi-adejumo\/"}]}},"_links":{"self":[{"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/posts\/562107"}],"collection":[{"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/users\/720"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/comments?post=562107"}],"version-history":[{"count":3,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/posts\/562107\/revisions"}],"predecessor-version":[{"id":562271,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/posts\/562107\/revisions\/562271"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/media\/562272"}],"wp:attachment":[{"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/media?parent=562107"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/categories?post=562107"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/tags?post=562107"},{"taxonomy":"prediction_market_topic","embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/prediction_market_topic?post=562107"},{"taxonomy":"post_folder","embeddable":true,"href":"https:\/\/cryptoslate.com\/wp-json\/wp\/v2\/post_folder?post=562107"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}