Brother, thank you verifying all the data I posted. I can assure you all is true and I was completely drained. This was already confirmed by Bitlifi, BTCPay Server and @C_Otto.

Yes some timings may not match exactly but who's looking at the watch while getting completely fucked? I can't remember exactly what time I got to the computer but I can assure you it was very late because I work on my projects all night long.

Regarding the NGINX log crossing over to Dec 7th: I restarted the node and BTCPay server after disabling the hacker accounts on BTCPay so that people using the server could move their sats to other wallets. I personally told them to do so. During that period there were a few other attempts to continue the attack but the accounts were already disabled.