BTCPay Server has urged users to update immediately or temporarily shut down their instances after disclosing a critical vulnerability that is being actively exploited. The open-source, self-hosted crypto payment processor warned that the flaw could lead to loss of funds and credited the Bitcoin Red Team with discovering and reporting the issue.
Critical Flaw Under Active Exploitation
In a security alert, BTCPay Server said threat actors were exploiting a newly identified vulnerability in the wild. The project advised all users to upgrade to the latest patched release as soon as possible or disable the service until they can apply the fix to mitigate potential financial impact.
The vulnerability was disclosed by the Bitcoin Red Team, a security-focused collective in the Bitcoin ecosystem known for responsible vulnerability reporting. BTCPay Server did not provide further public details in the initial notice beyond warning of the risk to funds and the need for immediate remediation.
What Is BTCPay Server?
BTCPay Server is an open-source, self-hosted payment processor that enables merchants and service providers to accept Bitcoin and, optionally, Lightning Network payments without relying on third-party intermediaries. Its self-custodial design gives operators direct control over infrastructure and funds, making timely security updates critical.
Recommended Actions for Users
- Update BTCPay Server to the latest patched version immediately.
- If an update cannot be applied right away, temporarily disable public access to the service.
- Review server and application logs for suspicious activity.
- Rotate API keys, access tokens, and administrative credentials associated with the deployment.
- Audit connected plugins and integrations, and remove unnecessary permissions.
Why It Matters
Active exploitation of a critical flaw in widely used, self-hosted payment infrastructure poses direct risks to businesses that process crypto payments. The incident underscores the importance of rapid patching, credential hygiene, and continuous monitoring across the Bitcoin merchant ecosystem.