#Bitpay vs copay update#
#Bitpay vs copay code#

“Narrowly escaped a mass theft/liquidation event. BitPay and its users were lucky this time but should be prepared for future attacks, according to GitHub user atomantic.

According to comments on GitHub, the malware “was really sneaky, and only triggering the upload of the private keys for wallets that had genuinely over 100 BTC in there”.

#Bitpay vs copay update#

Users should first update their affected wallets (5.0.2-5.1.0) and then send all funds from affected wallets to a brand new wallet on version 5.2.0, using the Send Max feature to initiate transactions of all funds.”īitPay found out about the malicious payload via a Copay GitHub issue report. “Users should not attempt to move funds to new wallets by importing affected wallets’ twelve word backup phrases (which correspond to potentially compromised private keys). The Atlanta-based firm warned users not to import affected wallets’ backup phrases as they too may be compromised. A security update version (5.2.0) has been released and will be available for all Copay and BitPay wallet users in the app stores momentarily.”Īdditionally, BitPay recommended users to move funds to new wallets (v5.2.0) immediately as private keys could be compromised. In the meantime, if you are using any Copay version from 5.0.2 to 5.1.0, you should not run or open the app. “Our team is continuing to investigate this issue and the extent of the vulnerability. The Bitcoin payment service warned customers not to use any infected Copay versions before running a security update provided by BitPay in the app stores.

#Bitpay vs copay code#

We are still investigating whether this code vulnerability was ever exploited against Copay users.” However, the BitPay app was not vulnerable to the malicious code. “Currently, we have only confirmed that the malicious code was deployed on versions 5.0.2 through 5.1.0 of our Copay and BitPay apps. BitPay Investigates Whether Code Vulnerability Exploited Copay UsersīitPay is currently investigating the matter as to whether Copay users suffered from any attack purported the malicious code, the company said in a statement. The company said the malicious code was deployed on versions 5.0.2 through 5.1.0 of its Copay and BitPay apps. BitPay recommended users to move funds to new wallets immediately as private keys are potentially compromised. Global Bitcoin payment service BitPay has warned customers of a vulnerability on a third-party NodeJS package used by the Copay and BitPay apps which could be used to capture users’ private keys.