BTCPay Server released an emergency update after identifying a critical vulnerability under active exploitation.
The flaw affected merchant software rather than Bitcoin itself and allowed TOTP-protected accounts to bypass two-factor authentication.
The vulnerability appeared in GitHub pull request #7491 and involved Greenfield API Basic Authentication. BTCPay’s authentication process checked whether valid FIDO2 credentials were registered instead of confirming whether two-factor authentication was enabled. TOTP-protected accounts could therefore access the API using only an email address and password.
BTCPay Server Releases Emergency Security Update
BTCPay released version 2.4.2 on August 7 and urged operators to upgrade immediately. Integrators were also advised to update NBXplorer to version 2.6.10 because the issue was described as a “critical vulnerability” under active exploitation.
The project recommended scoped API keys instead of Basic Authentication because permissions can be limited precisely. The patch also changes authentication checks so the system confirms whether two-factor authentication is active.
Because BTCPay is self-hosted, operators must apply the patch themselves without a central provider. They were also urged to review authentication and access logs for possible signs of compromise.
Bitcoin Market Holds Steady After Disclosure
Bitcoin traded near $64,889 after the disclosure, rising about 0.82% over 24 hours. Its market capitalization increased roughly 0.79% to $1.3 trillion, while trading volume climbed 20.98%.
The vulnerability exists in BTCPay’s application layer and does not affect Bitcoin’s consensus rules, cryptography, or blockchain. However, BTCPay links merchants with systems used for invoices, payments, and wallet management, meaning compromised operator accounts can still cause financial losses.
The incident followed another security disruption involving ZEUS, a Lightning wallet provider that disabled payment infrastructure after a security problem. Other Lightning service providers were also affected.
Bitcoin Payment Infrastructure Faces Broader Risks
A 2024 Northeastern University and TU Delft study used formal modeling to identify security issues in Lightning’s single-hop payment protocol, including a “Payout Race” attack. A separate 2026 study found balance-discovery attacks could reveal information about Lightning channel balances, while its proposed mitigation reduced information gain by up to 62% in simulations.
BTCPay previously disclosed CVE-2022-32984 in January 2023, a critical information leak affecting versions 1.3.0, 1.4.0, and 1.5.3. The flaw could expose store details, an xpub, and Lightning credentials. BTCPay fixed it in version 1.5.4 and awarded researcher Antoine Poinsot a $5,000 bounty.
River reported average Bitcoin usage by merchants rose 74% in 2025, while Lightning usage increased 300% and exceeded $1 billion in monthly volume. BuiltWith detected 248 BTCPay sites, including 74 active sites. The latest 1ML snapshot listed 6,280 Lightning nodes, 21,221 channels, and 2,818.49 BTC in network capacity.
For BTCPay operators, the priority is upgrading to version 2.4.2, updating NBXplorer, reviewing access logs, and using scoped API keys instead of Basic Authentication where possible.
