BTCPay Server warned on August 7, 2026, that a critical vulnerability in its self-hosted Bitcoin payment software is under active exploitation and can result in the loss of funds. The project told operators to update to version 2.4.2 immediately or shut their servers down.
Key Takeaways
- BTCPay Server says attackers are actively exploiting a critical flaw that can steal funds from merchant-run payment servers.
- Operators must install version 2.4.2 through the Admin Dashboard and confirm the new version string appears in the server footer.
- The project told anyone unable to update right away to take their server offline until the patch is installed.
- The team has not named the affected versions, the attack method, or any confirmed losses so far.
- The alert follows a volunteer review that flagged 4,962 potential issues across 390 Bitcoin-related software projects.
What Happened?
BTCPay Server issued the alert through its official X account, describing the flaw as critical and confirming that exploitation is already underway. “There is a critical vulnerability being actively exploited on BTCPay Server, which can result in the loss of funds,” the project said.
The team gave operators an exact update path. Administrators should open the Admin Dashboard, go to Server, then Maintenance, then Update, and verify that the version string displayed in the server footer reads 2.4.2.
The project directed users to the server’s official maintenance interface for the patch. It has not advised anyone to rely on third-party downloads or unofficial fixes, and it framed a temporary shutdown as the correct fallback for servers that cannot update at once.
There is a critical vulnerability being actively exploited on BTCPay Server, which can result in the loss of funds.
— BTCPay Server (@BtcpayServer) August 7, 2026
Please update your BTCPayServer to 2.4.2 by going to Admin Dashboard -> Server -> Maintenance -> Update & verify the 2.4.2 version string in the footer.
If you…
What the Project Has Not Disclosed?
The advisory leaves four questions open. BTCPay Server has not identified which previous versions are vulnerable, how attackers are gaining access, how many servers have been compromised, or whether any losses have been confirmed.
The project has also not published indicators of compromise, the technical markers operators could use to check whether their systems were targeted. Merchants who suspect unauthorized access currently have little official guidance beyond reviewing recent server activity for anything unusual.
That silence is likely deliberate. Publishing technical detail while a large share of installations remains unpatched would hand attackers a map to every server still running old code.
Why Self-Hosted Merchants Carry the Patch Burden?
BTCPay Server is an open-source payment processor that lets merchants take Bitcoin payments and Lightning Network transactions through infrastructure they control. That design removes reliance on a centralized payment provider and places responsibility for updates on individual merchants and server administrators.
No vendor can push this fix onto a merchant’s machine. Each unpatched server stays exposed until its own administrator acts, which explains why the project treats a full shutdown as an acceptable interim measure. A compromised installation could expose payment operations or other sensitive server functions, depending on how far the flaw reaches.
A Widening Bitcoin Security Review
The warning lands during a broader security push across Bitcoin infrastructure. Zeus Wallet went dark after an attack, taking its systems offline to contain the incident and audit them before restoring service. Zeus said no customer funds were lost, and no evidence currently ties that event to the BTCPay Server flaw.
The volunteer Bitcoin Red Team, whose work gathered pace after a July exploit affecting Coldcard hardware wallets, found 4,962 potential issues while reviewing 390 Bitcoin-related projects. The group classified 720 of those findings as high or critical severity across wallets, cryptographic libraries, and infrastructure software, though it has not publicly named projects with unresolved critical flaws.
The pattern matters because breaches of crypto infrastructure carry a long and costly record, one already visible in the industry’s most expensive crypto exchange hacks.
CoinLaw’s Takeaway
This alert sits at the serious end of the scale for payment software. Active exploitation plus a confirmed risk of stolen funds makes the upgrade an emergency action rather than routine maintenance. The safe sequence for operators today is short. Update, check the footer for the new version string, and review recent server activity for signs of unauthorized access.
The bigger story is the trade that comes with self-hosting. Running independent payment infrastructure removes custodial risk and adds a standing duty to patch fast. The thousands of issues flagged in the Bitcoin Red Team review suggest that duty is growing heavier across the ecosystem, and this incident shows what the gap between a published patch and an applied one can cost.
