BTCPay Server tells users to patch or power down, citing an actively exploited critical bug

BTCPay Server, the free open-source bitcoin payment processor, told its users on Friday to update immediately to version 2.4.2, saying a critical vulnerability is "being actively exploited" and that funds may be at risk. The advisory went out on the project's official X account and was reported by The Block, which cited that account directly.

The instruction to anyone who can't patch on the spot is blunt: "If you are unable to update right away, turn off your BTCPay Server to prevent unauthorized access until you can update," the project said.

Beyond that, almost nothing has been disclosed. The project has not said what the vulnerability is, which versions are affected, how the exploitation was discovered, how many servers have been hit, or whether any bitcoin has actually been taken. The Block reported it had contacted BTCPay Server for comment and flagged its own story as breaking and subject to update.

Context matters for who is exposed. BTCPay Server is self-hosted software that lets individuals and merchants accept on-chain bitcoin and Lightning payments with no fees and no intermediary — it was built as an alternative to BitPay. That architecture means there is no central operator who can push a fix or freeze anything. Every affected instance has to be patched, or turned off, by the person running it.

The disclosure lands days after the exploit against Coldcard, the Bitcoin-only hardware wallet brand, which The Block reports has produced at least $116 million in confirmed losses so far. The two incidents are separate and nothing in the current disclosures links them.

Key facts

• BTCPay Server disclosed a critical, "actively exploited" vulnerability on Friday, Aug. 7, 2026, via its official X account (reported by The Block).
• Fix version: 2.4.2. Users unable to update were told to shut the server down entirely.
• Number of victims and amount lost, if any: not disclosed. Technical details of the flaw: not disclosed.
• Coldcard exploit losses: at least $116 million confirmed, per The Block.

The real-world read

Coverage so far rests on a single short advisory from the project itself, relayed by one outlet. There is no CVE, no advisory text, no post-mortem — which is defensible during active exploitation, but it means nobody outside the project can currently size the damage or verify the fix's completeness. "Funds may be at risk" is the project's own characterization, not an independent finding.

Note also what "turn off your server" implies: the maintainers judged the risk high enough to recommend taking merchant payment infrastructure offline rather than wait. That is a stronger signal about severity than the sparse advisory language conveys.

Two disclosures on the sourcing: The Block states that Foresight Ventures, a crypto investor, is its majority owner, and that the exchange Bitget is an anchor LP for Foresight. Separately, the page carrying the story runs promotional placements for LMAX Digital and Polymarket — advertising, not reporting, and unrelated to the story's substance.

Opinion, and whose

None offered. No analyst, researcher, or firm has publicly assessed the flaw's scope or root cause. The one interpretive claim in circulation — that Coldcard exposed crypto's "original sin" of private keys — is attributed by The Block to Blockaid's CEO and concerns a different incident.

Sources

• The Block, Daniel Kuhn (Aug. 7, 2026) — the report of the advisory, the 2.4.2 version number, the shutdown instruction, the $116 million Coldcard figure, and the pending comment request. Marked by the outlet as breaking. Its parent-company disclosure is noted above.
• BTCPay Server's official X account — the primary source for the advisory and its wording, as quoted by The Block.
• Promotional units for LMAX Digital and Polymarket appeared alongside the source article. Marketing; not used.

Not financial advice. If you run BTCPay Server, the operational instruction here comes from its maintainers, not from us.