Back Cryptorank

BTCPay emergency patch exposes merchant-side Bitcoin security risk

Cryptorank • August 8, 2026

BTCPay Server, the open-source Bitcoin merchant payment software, issued an emergency update after a vulnerability (GitHub PR #7491) was actively exploited to bypass TOTP two-factor authentication via its Greenfield API Basic Authentication, allowing attackers to potentially steal funds from merchants. The patch addresses a critical crypto security risk for merchant wallets and payment providers, underscoring the need for rapid protocol updates to protect adoption and custody, and indicating short-term negative impact on trust.

See what traders are focused on

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

BTCPay Server Patch Addresses Critical Bitcoin Security Vulnerability BTCPay Server released an emergency update on August 7, 2026, to address a vulnerability (GitHub PR #7491) that allowed cybercriminals to bypass TOTP two-factor authentication via its Greenfield API Basic Authentication. This flaw potentially exposed merchant wallets to theft, as attackers could access accounts using only email and credentials. The vulnerability stems from an authentication check that failed to verify if the two-factor system was enabled. Merchants using BTCPay are advised to upgrade to version 2.4.2 and NBXplorer to version 2.6.10 to mitigate risks. Despite the vulnerability, Bitcoin's market price remains stable at $64,889, with a market cap of $1.3 trillion. The incident highlights the importance of rapid updates in maintaining trust and security in cryptocurrency transactions. BTCPay's self-hosted nature means operators must implement the patch independently. 2 sources 72

BTCPay emergency patch exposes merchant-side Bitcoin security risk

The full story

Extracted Entities

Attack Types (1)

Platforms (1)