BTCPay Server Patch Addresses Critical Bitcoin Security Vulnerability

BTCPay Server released an emergency update on August 7, 2026, to address a vulnerability (GitHub PR #7491) that allowed cybercriminals to bypass TOTP two-factor authentication via its Greenfield API Basic Authentication. This flaw potentially exposed merchant wallets to theft, as attackers could access accounts using only email and credentials. The vulnerability stems from an authentication check that failed to verify if the two-factor system was enabled. Merchants using BTCPay are advised to upgrade to version 2.4.2 and NBXplorer to version 2.6.10 to mitigate risks. Despite the vulnerability, Bitcoin's market price remains stable at $64,889, with a market cap of $1.3 trillion. The incident highlights the importance of rapid updates in maintaining trust and security in cryptocurrency transactions. BTCPay's self-hosted nature means operators must implement the patch independently.

Key Points: • A critical vulnerability in BTCPay Server allows bypassing of TOTP two-factor authentication. • Merchants are urged to upgrade to BTCPay version 2.4.2 and NBXplorer version 2.6.10. • The vulnerability does not affect Bitcoin's core protocol but poses risks to merchant funds.