Home›Crypto›Market Structure›BTCPay Server warns of critical vulnerability under ac…

BTCPay Server warns of critical vulnerability under active attack

BTCPay Server urged operators to update to version 2.4.2, replace exposed macaroons credentials, and recreate the macaroons.db file to reduce the risk of stolen funds.

Reported · Written up by our desk · Market Structure

BTCPay Server, the Bitcoin payment processor, warned that attackers are actively exploiting a critical vulnerability that could lead to stolen funds. The company urged administrators to either update immediately or shut down their BTCPay Server instances until the fix is applied.

In a post shared on X, BTCPay Server said operators should install version 2.4.2 and confirm the update in the server footer. If admins cannot update right away, the company recommended turning off the servers to prevent unauthorized access.

BTCPay Server also told users to replace macaroons, the credentials it says may have been exposed, and to recreate the macaroons.db file. It further said administrators should refresh authentication strings for other Lightning Network backends and, if they generated a hot on-chain wallet in BTCPay, move those funds and recreate the wallet.

The company has not disclosed how the flaw works, when the attacks began, how many servers were compromised, or whether any funds were stolen. In its update, Decrypt noted that the alert comes as security reporting has increasingly pointed to faster vulnerability discovery driven by AI-assisted techniques across crypto projects.

Latest closeBitcoin $64,906.59 ▲1.0%

More like this

Sources