BTCPay Server has shipped version 2.4.7, a security-focused release that resolves 85 findings and strengthens protections for businesses accepting Bitcoin payments. The update, published on October 29, targets weaknesses affecting payment processing, authentication, and merchant account security.

The release arrives at a sensitive moment for self-hosted cryptocurrency payment infrastructure. On November 2, the BTCPay Server team separately confirmed that Bitcoin and Litecoin had been stolen from merchants running outdated installations, adding urgency for operators to review their systems.

85 Findings Resolved Under Anthropic's OSS Scanner Program

According to the project's official release notes, version 2.4.7 addresses 85 findings identified through Anthropic's OSS Scanner program. The breakdown includes one critical vulnerability, 13 high-severity issues, 52 medium-severity findings, and 19 low-severity problems.

The fixes span several core components of the payment platform. Developers reinforced payout restrictions, invoice access controls, two-factor authentication, and API permissions to reduce the risk of unauthorized activity. The update also remediated weaknesses in checkout forms and merchant account isolation—changes described as particularly significant for service providers hosting multiple businesses on shared infrastructure.

BTCPay Server urged administrators to apply the update promptly, especially where several merchants share a single installation.

Theft Disclosures Involving Outdated Installations

The security release took on added weight after BTCPay Server disclosed cryptocurrency thefts tied to older software versions. In an incident disclosure on the project's official blog, developers confirmed on November 2 that attackers had targeted installations running version 2.4.1 or earlier. The attacks exploited a vulnerability that had already been patched in version 2.4.2, released in August. That places the exploited flaw outside the scope of the 85 scanner findings addressed in version 2.4.7, separating the two security efforts.

The team reported no observed impact on servers already running version 2.4.2 or later at the time the November 1 warning was issued.

However, the project cautioned that updating a compromised installation may not eliminate existing unauthorized access. Operators of affected systems should migrate to fresh servers, replace potentially exposed credentials, and establish new wallets. The project's incident notice remains the reference point for operators determining whether their installations fall within the affected range disclosed by the team.

Security Burden Falls on Self-Hosted Operators

BTCPay Server enables businesses to accept cryptocurrency payments without relying on traditional payment processors. That independence, however, places software maintenance and infrastructure security directly in merchants' hands. For businesses handling customer transactions, delayed updates can expose sensitive information and heighten financial risk.

Administrators are advised to maintain reliable backups, monitor for suspicious activity, and limit funds held in internet-connected wallets.

The developments underscore a broader challenge facing cryptocurrency payment infrastructure: as digital asset adoption expands, consistent security maintenance remains essential for protecting merchant funds and preserving customer confidence.

Primary source: BTCPay Server security incident notice (versions 2.4.1 and earlier)