BTCPay warns of active exploit in Bitcoin payment server

BTCPay’s development team posted a security advisory warning that attackers are actively exploiting a payment-handling flaw in BTCPay Server and urged immediate action by operators.

The vulnerability affects how the server validates and records incoming payments. Exploitation can interfere with invoice processing and payment verification, potentially causing invoice states to change incorrectly or allowing invoices to be marked as paid without actual confirmation on the blockchain.

Developers discovered the issue after reports of unusual transaction behavior. The advisory describes ongoing exploitation as the reason for the rapid notice and does not include a public disclosure date for the vulnerability.

Administrators are asked to update BTCPay Server to the patched release where available or apply the temporary mitigations provided by the team. The advisory recommends reviewing recent invoice and transaction logs for signs of manipulation, and temporarily suspending automatic checkout processes when possible. If there is evidence of unauthorized access, operators should rotate API keys and webhook secrets.

Exposure varies by deployment. Configuration differences and extra security layers can change how the flaw affects an instance. Both self-hosted and third-party hosted installations have been targeted, with attackers using automated scripts to probe reachable servers. Hosted service operators may need to coordinate separately with providers to confirm updates.

Merchants are advised to check transaction confirmations directly on the blockchain and to avoid accepting large or time-sensitive payments until their instance is secured. The advisory includes guidance on handling disputed or unconfirmed payments and recommends consulting payment logs and wallet histories to verify fund receipts.

BTCPay is working with blockchain security researchers and independent auditors to analyze attack patterns and refine detection rules. Further technical notes will be published after additional analysis, and users are asked to monitor the project’s official channels for updates.

BTCPay Server is an open-source Bitcoin payment processor used by merchants and services to accept on-chain and Lightning payments without third-party processors.