BTCPay Server issues urgent alert on active exploit

The developers of BTCPay Server, an open-source, self-hosted Bitcoin payment processor, issued an urgent security warning on Friday, August 7, 2026, urging all users to immediately update their software to version 2.4.2. The alert, posted on social media, stated that a critical vulnerability is being actively exploited by attackers, which could result in the loss of user funds.

The project instructed server administrators to update via the Admin Dashboard and verify the version number in the server footer. For those unable to apply the patch immediately, the developers recommended shutting down their BTCPay Server instances entirely to prevent unauthorized access until the update can be completed. Additional security steps advised included replacing authentication credentials known as macaroons, refreshing related database files, and moving funds from any on-chain hot wallets generated within the software.

While the exact nature of the vulnerability and the total scope of financial losses have not been disclosed, at least two specific instances of drained funds have been reported publicly. Zack Herbert, CEO of Foundation, reported that their node was drained overnight, and a...