BTCPay Server warns of critical flaw under active exploitation; patch details not yet public

BTCPay Server, the open-source self-hosted Bitcoin payment processor, has issued a warning that a critical vulnerability in the software is being actively exploited, according to a Decrypt report published on 7 August 2026 at 20:00 UTC.

That is the extent of what has been publicly established. Decrypt's report — headlined "Bitcoin Payment Service BTCPay Warns Critical Flaw Is Under Active Attack" — carries no CVE identifier, no affected version range, no description of the attack path, and no fixed release number. Nor has the underlying BTCPay Server advisory itself, which would be the primary document here, been reproduced in circulation. Merchants running the software have a warning and no version number to check against, which is the worst possible state for a self-hosted product.

Some background on why that matters, and it is background rather than a sourced claim: BTCPay Server's entire design premise is that no third party sits between a merchant and their payments — no custodian, no KYC gate, no hosted API. The corollary is that there is no central operator who can push a fix. Every instance is patched by whoever runs it, or it isn't patched. An "under active attack" advisory in that architecture is an unusually urgent piece of news, because the remediation clock runs separately on every deployment.

For price context at the moment of the report, Decrypt's own price ticker showed bitcoin at $64,916.00 and ether at $1,916.78. No market reaction has been attributed to the disclosure.

Key facts

• BTCPay Server has warned of a critical flaw described as under active attack — Decrypt, 7 August 2026, 20:00:34 UTC.
• No CVE number, affected versions, patched release, or exploitation details appear in that report.
• BTCPay Server's own security advisory is the primary source on this and has not been quoted or linked in the reporting at hand.
• BTC $64,916.00, ETH $1,916.78, SOL $73.84, XRP $1.024 — Decrypt price ticker, same timestamp.

The real-world read

The honest read is that this is a headline, not yet a story. A single secondary outlet is carrying a warning whose primary document — the advisory — isn't in public circulation alongside it. Cleartext's default is to anchor on primary sources; here there is none to anchor on, and that gap is the news as much as the flaw is.

Two things are conspicuously absent. First, the operational specifics an affected merchant would actually need: version, vector, fix. Second, any evidence of scope — "under active attack" is a serious characterisation, but no incident count, victim, or loss figure supports it in what has been published. That is not a reason to dismiss the warning; it is a reason to treat the severity framing as unverified until BTCPay's advisory is read directly.

Nothing in this set is marketing or sponsored. The only promotional surface is Decrypt's embedded price ticker, which is the outlet's own product furniture and not evidence of anything.

Opinion, and whose

None to report. No analyst, vendor, or researcher forecast appears in the available reporting, and no one has publicly estimated the flaw's blast radius. The only forward-looking element is the "active attack" characterisation itself, which traces to BTCPay Server via Decrypt.

Sources

• Decrypt (Tier 2, reputable secondary), 7 August 2026 — sole report of the BTCPay Server warning; supplied the active-exploitation framing and the price ticker figures. Decrypt attributes the warning to BTCPay Server but does not reproduce the advisory text.

Not financial advice. If you operate a BTCPay Server instance, check the project's own security advisory directly rather than relying on secondhand summaries.