We’ve released BTCPay Server v2.4.3-rc6. Pending final testing, this should be the last release candidate before the fully open-source v2.4.3 release, which we aim to publish later this week. To update, go to Server Settings > Maintenance and click Update.

Today, we are releasing BTCPay Server v2.4.3-rc4, a security update addressing vulnerabilities reported by the Bitcoin Red Team, @ProjectLoupe, @MagicGrants, @Premai_io, and independent researchers. This release follows several days of nonstop work, review, and testing. It was built from our temporary private security repository, but to make these security fixes available as quickly as possible, we are releasing the Docker image publicly now. This is a release candidate, so bugs may still be present. NFC is now opt-in, and the Phoenixd plugin is temporarily incompatible with this release. Please report any issues to the team. We will document behavioral changes within the main release. Despite its RC status, we strongly recommend upgrading now using the standard process: Server Settings > Maintenance > Update or run or run btcpay-update(.)sh from the command line, removing the parentheses If no significant issues are reported, the release candidate will be tagged as v2.4.3 and fully open-sourced within the next 48 hours.

We're donating 0.21 BTC to @craigraw and 0.21 BTC to the Bitcoin Red Team for their responsible security disclosure of the recent critical vulnerability. In addition, friends and supporters of the BTCPay Server project have committed to funding a bounty to recover the stolen funds. The bounty will be 10% of the amount recovered, up to a maximum of 3 BTC for full recovery of the funds. These are modest contributions, but they are what we can offer as a FOSS project and a way to appreciate people doing critical security work, which helps the entire ecosystem. To anyone with actionable information that could lead to a recovery, including the attacker, please contact: security@btcpayserver.org. Signal and other secure communication channels can be provided upon request. If multiple reports contribute to the recovery, the bounty will be split in coordination with the victims, based on the amount each victim lost, the funds recovered, how useful the information was to the recovery efforts, and other relevant factors.

It wasn't an AI, it was @craigraw who figured out the vulnerability as @NicolasDorier previously shared. If you were impacted by vulnerability, please send all the information to security email, it matters a lot. And thanks to all of you engaging here on X, you're tremendously helping with the investigation 🙏

BTCPay Server is donating 0.21 BTC to @craigraw and 0.21 BTC to the Bitcoin Red Team for responsibly disclosing a critical vulnerability. They're also putting up a bounty for recovering the stolen funds, 10% of whatever is recovered, up to 3 BTC max. If you have info that could help recover the funds, contact security@btcpayserver.org.

We're donating 0.21 BTC to @craigraw and 0.21 BTC to the Bitcoin Red Team for their responsible security disclosure of the recent critical vulnerability. In addition, friends and supporters of the BTCPay Server project have committed to funding a bounty to recover the stolen funds. The bounty will be 10% of the amount recovered, up to a maximum of 3 BTC for full recovery of the funds. These are modest contributions, but they are what we can offer as a FOSS project and a way to appreciate people doing critical security work, which helps the entire ecosystem. To anyone with actionable information that could lead to a recovery, including the attacker, please contact: security@btcpayserver.org. Signal and other secure communication channels can be provided upon request. If multiple reports contribute to the recovery, the bounty will be split in coordination with the victims, based on the amount each victim lost, the funds recovered, how useful the information was to the recovery efforts, and other relevant factors.

If anyone has contact with @zachxbt, other security researchers or security teams at exchanges, please share this post with them. I am already reaching out to the people I know, but I would appreciate additional intros and sharing information on the @BtcpayServer exploit. Thank you in advance 🙏

Reported addresses linked to exploits of vulnerable BTCPay Server instances: 19jSfadPiKa4aCefj4F7uEYbhMEt2L8SCH 17C7EZC1VTrXzSQneiaJv2W6tQh1vCRSnF If your incident involved another address, please share it.

Our analysis confirms that the attacker used exposed LND .macaroon credentials to access funds. Only LND users are affected, but we recommend everyone update to BTCPay Server 2.4.2. We found no evidence that on-chain or hot wallets created in BTCPay Server were affected. Thank you to everyone in the community who sounded the alarm, helped us spread this information quickly, and contacted merchants. Please continue reaching out to BTCPay Server operators you know and ask them to update. I am deeply sorry to the users who suffered devastating losses. If you were affected or have more questions my DMs are open.

There is a critical vulnerability being actively exploited on BTCPay Server, which can result in the loss of funds. Please update your BTCPayServer to 2.4.2 by going to Admin Dashboard -> Server -> Maintenance -> Update & verify the 2.4.2 version string in the footer. If you are unable to update right away, turn off your BTCPay Server to prevent unauthorized access until you can update.

🚨PSA for LND + BTCPay Server users🚨 Don’t assume you’re safe after upgrading. You’re going to want to explicitly destroy your macaroons and macaroons.db and recreate them fresh. This also applies to auth mechanisms for other LN backends. Also, if you generated a hot on-chain wallet in BTCPay you want to move those funds.

There is a critical vulnerability being actively exploited on BTCPay Server, which can result in the loss of funds. Please update your BTCPayServer to 2.4.2 by going to Admin Dashboard -> Server -> Maintenance -> Update & verify the 2.4.2 version string in the footer. If you are unable to update right away, turn off your BTCPay Server to prevent unauthorized access until you can update.