BTCPay Server Warns of Critical Flaw Under Active Attack

The Disclosure

BTCPay Server, a self-hosted Bitcoin payment processor used by merchants and platforms worldwide, disclosed a critical vulnerability under active exploitation and instructed all users to install the latest version immediately. The company also directed users to replace any credentials that may have been compromised, though it did not elaborate on which credentials or how they might have been exposed.

Immediate Actions Required

BTCPay recommended affected operators rotate API keys, pairing codes, and other authentication material as a precaution. The company did not publish technical details of the vulnerability or the attack chain, a common practice in coordinated disclosure to avoid widening exposure while patches propagate. The urgency of the warning — and the mention of active attacks — suggests the flaw poses material risk to any unpatched instance connected to the internet.

Context

BTCPay Server is open-source infrastructure used by e-commerce platforms, donation processors, and point-of-sale systems to accept Bitcoin payments without intermediaries. A compromise of the software or its instances could enable attackers to intercept payments, drain wallets, or harvest payment data from connected merchants.

Why It Matters

For Traders

Active exploitation of a merchant infrastructure component may disrupt payment flows and reduce Bitcoin adoption friction in e-commerce short-term.

For Investors

Security incidents in core payment infrastructure erode merchant confidence and can slow adoption of self-custody and direct payment rails.

For Builders

BTCPay users and dependents should prioritize patching immediately; the active-exploitation status suggests exploitation tools are already in circulation.