Makers of the free, open-source bitcoin payment processor BTCPay urged users to update their servers as a critical vulnerability is “being actively exploited.”

We'd love your feedback.

Take a 30-second survey to help improve The Block.

BTCPay Server disclosed that a critical vulnerability is "being actively exploited" on Friday and urged users to update their servers to version 2.4.2, according to its official X account.

While the team said funds may be at risk, it is unclear how many users have been exploited or how much has been lost, if any.

"If you are unable to update right away, turn off your BTCPay Server to prevent unauthorized access until you can update," BTC Pay said.

Details surrounding the attack are also currently limited. The Block reached out to BTCPay Server for comment.

BTCPay Server is a free, open-source, self-hosted bitcoin payment processor that lets individuals and businesses accept bitcoin and Lightning payments directly with no fees or intermediaries. Launched as an alternative to BitPay, it has gained particular affection among Bitcoin maximalists.

The vulnerability comes on the heels of the Coldcard exploit affecting a popular brand of Bitcoin-only wallets that has led to at least $116 million in confirmed losses so far.

This article is breaking and may be updated as The Block learns more.

Disclaimer: The Block is an independent media outlet that delivers news, research, and data. As of November 2023, Foresight Ventures is a majority investor of The Block. Foresight Ventures invests in other companies in the crypto space. Crypto exchange Bitget is an anchor LP for Foresight Ventures. The Block continues to operate independently to deliver objective, impactful, and timely information about the crypto industry. Here are our current financial disclosures.

RATINGS

Best crypto cards with token rewards in 2026

See more ratings