BTCPay Server, the widely used open-source platform that enables merchants and individuals to accept Bitcoin and Lightning Network payments on self-hosted infrastructure, issued an emergency security warning on August 7, 2026. The project stated that a critical vulnerability is under active exploitation and can lead to the loss of funds.

Administrators were instructed to update immediately to version 2.4.2. The recommended path is through the Admin Dashboard under Server, Maintenance and Update. After the process completes, operators must confirm that the version string “2.4.2” appears in the server footer.

Those unable to complete the update without delay were told to shut down their BTCPay Server instances entirely until the patched release can be installed. Leaving an unpatched server running leaves it exposed to unauthorized access.

Additional Protective Steps Required

Beyond the core software update, BTCPay Server directed users of Lightning Network integrations to replace credential files known as macaroons, recreate the macaroons.db file, and refresh authentication strings for other Lightning backends. Operators who generated hot on-chain wallets through the platform were advised to move those funds to new addresses and recreate the wallets.

The vulnerability affects all versions prior to 2.4.2, including release candidates of that version. After review, the project determined that the primary credential risk centers on LND, an implementation of the Lightning Network. Users running other Lightning implementations or not using Lightning at all face lower exposure on that specific vector, though the project still strongly recommended the update for everyone.

BTCPay Server credited members of the Bitcoin Red Team with identifying and reporting the flaw. The project has not released technical details of the attack method, the precise start date of exploitation, the number of compromised servers, or a comprehensive total of funds lost. It confirmed, however, that attackers successfully exploited the issue, that some users were affected, and that funds were stolen.

Context of Self-Hosted Payment Infrastructure

BTCPay Server allows operators to process payments without relying on centralized custodial providers. This design gives merchants full control over their infrastructure but also places full responsibility for timely security updates on individual administrators. A successful compromise of an installation can expose payment operations and related server functions.

The timing of the disclosure coincides with heightened scrutiny of Bitcoin ecosystem software. Security researchers have recently examined large numbers of open-source Bitcoin-related projects and identified thousands of potential issues, including hundreds rated high or critical severity. Separate incidents involving hardware wallets and other Lightning-related services have also drawn attention in recent weeks.

BTCPay Server has not indicated whether artificial intelligence tools played a role in discovering or exploiting the present vulnerability. The project has limited further public comment while operators apply the patch, stating that additional technical disclosure will wait until more systems are secured.

Immediate Guidance for Operators

Server administrators are advised to treat the upgrade as an emergency measure rather than a routine maintenance task. Systems that cannot be confirmed as running version 2.4.2 should remain offline. Operators may also wish to review recent server activity for any signs of unauthorized access, though the project has not yet published specific indicators of compromise.

The fixed release is available through the official maintenance interface. The project has not endorsed third-party downloads or unofficial workarounds. Further updates from BTCPay Server are expected once a larger share of the user base has applied the patch.