BTCPay Server, the open-source, self-hosted payment processing software that enables merchants to accept Bitcoin without relying on a third-party custodian, has released an emergency update to address a critical vulnerability currently being exploited to steal user funds.

As detailed in GitHub pull request #7491, the flaw allows attackers to bypass TOTP-based two-factor authentication through BTCPay's Greenfield API Basic Authentication. The root cause lies in how the authentication mechanism verified whether valid FIDO2 credentials were registered, rather than confirming whether two-factor authentication was actually enabled. As a result, accounts protected by a TOTP authenticator app could be accessed via the API using only an email address and password. The Greenfield API is BTCPay's REST-based interface used for programmatic integration with e-commerce platforms, point-of-sale systems, and automated workflows — meaning merchants with API-driven setups face the broadest exposure.

The vulnerability exists within the BTCPay application layer and does not affect the Bitcoin (BTC) protocol itself. BTCPay released version 2.4.2 of its software on August 7 and advised all users to ensure they have also updated NBXplorer to version 2.6.10.

BTCPay addressed the incident publicly via its X account.

Market Response Remains Subdued

Despite the security concern, Bitcoin's market price and valuation have remained relatively stable. According to CoinMarketCap, Bitcoin is trading at approximately $64,889, a 0.82% increase from the previous day, while its $1.3 trillion market capitalization has risen only 0.79%. Although 24-hour trading volume increased by 20.98%, the stable price and market cap suggest the incident has not materially impacted Bitcoin's overall market valuation.

The muted market reaction is consistent with the nature of the vulnerability. The BTCPay flaw affects individual merchants and operators, not Bitcoin's consensus rules or cryptographic foundations. However, the impact should not be dismissed. BTCPay serves as a bridge between the Bitcoin network and business payment systems — handling invoicing, payment processing, and wallet management. The platform's non-custodial design means merchants retain direct control of their private keys, a key reason many chose it over hosted processors. An authentication bypass that grants attackers access to operator accounts undermines that security model directly, potentially exposing wallet management functions and payment data even though funds are not custodied by a third party.

Remediation Guidance for Operators

The immediate fix is straightforward: upgrade BTCPay Server to version 2.4.2, and for integrators, upgrade NBXplorer to version 2.6.10. BTCPay recommends using API keys instead of Basic Authentication, as API keys allow for more granular permission controls.

The patch introduces changes to the authentication process that verify whether 2FA is genuinely active, closing the gap that previously allowed TOTP-protected accounts to bypass the second authentication factor. Because BTCPay is self-hosted, operators cannot rely on a central provider to apply the patch and must take action independently — a reality that also means the window of exposure may remain open for deployments that are not actively monitored or maintained. Additional documentation is available from BTCPay.

A Pattern of Payment Infrastructure Vulnerabilities

BTCPay's announcement follows a turbulent week for Bitcoin payment infrastructure. As previously reported, ZEUS, a Lightning wallet provider, took its payment infrastructure offline due to a security issue, with other Lightning service providers also affected.

These incidents do not indicate failures in Bitcoin's core payment protocols. They do, however, highlight the security risks introduced by software layers built around the blockchain. For merchants evaluating Bitcoin payment stacks, the recurring nature of these disclosures underscores that infrastructure selection now carries ongoing operational risk comparable to traditional payment gateway management — including the need for patch-tracking, access auditing, and incident response planning.

A 2024 study by researchers from Northeastern University and TU Delft used formal modeling to identify security weaknesses in Lightning's single-hop payment protocol, including a newly described "Payout Race" attack. A separate 2026 study examined balance-discovery attacks, finding that attackers could infer information about Lightning channel balances. Its proposed mitigation reduced information leakage by as much as 62% in simulations.

Both studies underscore a broader reality: Bitcoin's security extends well beyond the blockchain itself. Wallets, APIs, payment processors, and Lightning infrastructure all introduce additional attack surfaces.

BTCPay's History of Vulnerabilities

This is not BTCPay's first critical bug. In January 2023, the project disclosed CVE-2022-32984, a critical information leak affecting BTCPay versions 1.3.0, 1.4.0, and 1.5.3. That flaw could expose sensitive store details — including an xpub and Lightning credentials tied to an external node — through publicly accessible Point of Sale applications. BTCPay resolved the issue in version 1.5.4 and awarded researcher Antoine Poinsot a $5,000 bounty.

The distinction between the two incidents is notable: the 2023 vulnerability was an information disclosure issue, whereas the current flaw involves an authentication bypass that circumvents TOTP security through the Greenfield API. The progression from data exposure to active authentication circumvention reflects the escalating sophistication of vulnerabilities being identified in Bitcoin-adjacent software.

Growing Stakes for Merchants

The risk profile for merchants is intensifying as Bitcoin adoption for payments accelerates. Research from River published in February 2026 found that average Bitcoin usage by merchants increased 74% in 2025, while Lightning usage surged 300%, surpassing $1 billion in monthly volume.

The surrounding infrastructure is substantial. BuiltWith has detected 248 websites using BTCPay Server, including 74 active installations — figures that do not account for private or otherwise undetectable deployments. Meanwhile, the latest 1ML snapshot shows 6,280 Lightning nodes, 21,221 channels, and a total network capacity of 2,818.49 BTC.

At that scale, vulnerabilities in the surrounding infrastructure carry significant consequences, even when the Bitcoin base layer remains unaffected. The BTCPay incident does not indicate a flaw in Bitcoin itself; rather, it demonstrates that businesses built on Bitcoin inherit a broader security burden. The blockchain may continue operating as designed, but the applications merchants rely on can become points of failure.

For BTCPay operators, the priorities are clear: upgrade to version 2.4.2, review authentication and access logs for signs of compromise, and switch from Basic Authentication to specific API keys wherever possible.