Catenaa, Thursday, August 13, 2026- BTCPay Server has warned users that attackers are actively exploiting a critical security vulnerability that could put funds at risk, urging operators to immediately upgrade their systems or temporarily shut them down. BTC PayServer issued the warning via an X post.
The open-source Bitcoin payment processor disclosed the vulnerability Friday and advised all users to update to BTCPay Server version 2.4.2.
Operators unable to install the update immediately should switch off their BTCPay Server instances to prevent unauthorized access until they can upgrade, the project said.
The warning indicates the vulnerability is not merely theoretical. However, BTCPay has not disclosed how attackers are exploiting the flaw or how many installations may have been compromised.
It also remains unclear whether funds have already been stolen and, if so, how much.
BTCPay Server is a free, open-source and self-hosted Bitcoin payment processing platform.
It allows merchants and individuals to accept Bitcoin and Lightning Network payments directly without relying on a conventional payment intermediary.
That self-hosted structure gives operators greater control over their payment infrastructure but also places responsibility for maintaining and securing their servers directly on users.
The project’s recommendation to shut down servers that cannot immediately be patched highlights the severity of the vulnerability.
For businesses using BTCPay for live payments, that creates a difficult trade-off between temporarily interrupting payment processing and leaving potentially vulnerable infrastructure online.
The incident comes shortly after another major security problem affected the Bitcoin ecosystem.
A vulnerability involving Coldcard hardware wallets has resulted in at least $116 million in confirmed losses, according to figures cited by The Block.
Galaxy Research has estimated potential losses from the Coldcard incident could ultimately reach about $130 million.
The two vulnerabilities involve different technologies and there is no indication they are connected.
However, their proximity highlights the continuing security risks surrounding infrastructure that users depend on to hold, transfer and receive Bitcoin.
BTCPay’s disclosure also reinforces a basic distinction within self-custody infrastructure.
Removing financial intermediaries can give users greater control over their assets, but it can also shift responsibility for software updates, private keys and operational security directly to individuals and businesses.
For BTCPay operators, the immediate priority is straightforward: upgrade to version 2.4.2 or take affected servers offline until the update can be installed.
Further details about the vulnerability, its exploitation and potential financial losses have yet to emerge.
