Best way to accept #Bitcoin. No fees, no intermediary. Free, open source & self-hosted Bitcoin payment processor for self-sovereign individuals and businesses.
Joined December 2017
- Tweets8.9K
- Following29
- Followers57.2K
- Likes9.8K
Pinned Tweet
📢 Security Incident Affecting BTCPay Server 2.4.1 and Earlier
Read the full security advisory, including details & timelines, on our blog: blog.btcpayserver.org/btcpay…
If you were impacted, please send all details and logs to [email protected]
🚨 We are receiving reports of hot wallets on BTCPay Servers being swept by unauthorized attackers.
If you're running an instance, please shut it down (./btcpay-down.sh) until we complete the investigation.
📢 Our incident response investigation identified an attack vector targeting instances running versions 2.4.1 (Jul 23, 2026) or older.
We have no credible reports of hot wallet drains for users running the latest 2.4.7 release. We again urge everyone to keep their BTCPay Server updated.
If you were impacted, please send all details and logs to [email protected]
UPDATE 2:
teapawt.org/BtcpayServer/status/21…
📢 Security Incident Affecting BTCPay Server 2.4.1 and Earlier
Read the full security advisory, including details & timelines, on our blog: blog.btcpayserver.org/btcpay…
If you were impacted, please send all details and logs to [email protected]
BTCPay Server retweeted
We will publish a blog post going to more details.
But at least for those who already updated at least once since the release of 2.4.2, there is no reason to panic.
Please update often. Especially those days!
Also, don't keep too much in your Hot Wallet.
📢 Our incident response investigation identified an attack vector targeting instances running versions 2.4.1 (Jul 23, 2026) or older.
We have no credible reports of hot wallet drains for users running the latest 2.4.7 release. We again urge everyone to keep their BTCPay Server updated.
If you were impacted, please send all details and logs to [email protected]
📢 Our incident response investigation identified an attack vector targeting instances running versions 2.4.1 (Jul 23, 2026) or older.
We have no credible reports of hot wallet drains for users running the latest 2.4.7 release. We again urge everyone to keep their BTCPay Server updated.
If you were impacted, please send all details and logs to [email protected]
If you run BTCPay Server through a hosting provider, your instance may have been shut down automatically to keep older versions from being exploited.
We thank @LunaNode and other hosting providers for their swift action after our initial announcement.
BTCPay Server retweeted
Update on my part: Our public servers were not attacked (on 2.4.7), it seems reports are on before 2.4.2.
The attacker managed to log in as admin on those instance, we are still trying to figure out how.
BTCPay Server retweeted
Thanks @r0ckstardev and @MrKukks for leading the way on CVE 2026-98432. I used both sources and one from Akamai to deploy a fix until kernel update available for my other servers in the wild. If you use BTCPay Server you don't need this.
github.com/ndeet/cve-2026-98…
BTCPay Server retweeted
🚨PSA: If using @BtcpayServer Docker installation, RUN THE UPDATER. We are patching the critical linux vulnerability automatically across all machines.
github.com/btcpayserver/btcp…
🚨 We're releasing BTPay Server 2.4.7 an emergency update fixing one critical and several medium-severity security vulnerabilities brought to our attention through @Anthropic's frontier OSS scanner.
We recommend that you update your BTCPay Server as soon as possible.
BTCPay Server retweeted
We just shipped another security update to @BtcpayServer which fixes one critical and dozen of high to low impact vulnerabilities discovered by @AnthropicAI FOSS security scanner we got access to. No need to panic, this time we got access to models before attackers, update to mitigate no evidence of exploits.
🚨 We're releasing BTPay Server 2.4.7 an emergency update fixing one critical and several medium-severity security vulnerabilities brought to our attention through @Anthropic's frontier OSS scanner.
We recommend that you update your BTCPay Server as soon as possible.
BTCPay Server retweeted
🚀 Update your BTCPay Server instances to 2.4.7!
Not as critical as the August fixes were - but luckily, this time we got access to frontier AI before attackers did.
Kudos to @AnthropicAI for the scans, and to @NicolasDorier, @MrKukks & the rest of the team for quickly fixing the problems.
🚨 We're releasing BTPay Server 2.4.7 an emergency update fixing one critical and several medium-severity security vulnerabilities brought to our attention through @Anthropic's frontier OSS scanner.
We recommend that you update your BTCPay Server as soon as possible.
To update:
- In BTCPay Server: If you're a server admin, go to Server Settings → Maintenance → click the Update button.
- Docker (most servers): Log in over SSH and run:
sudo su -
cd btcpayserver-docker
btcpay-update(.)sh (remove parentheses)
- Node platforms (@umbrel @start9labs etc): Install the update as soon as your platform makes it available.
As a small team defending against Al-assisted attacks, we're grateful to @Anthropic for including us in the program and responsibly disclosing the vulnerabilities.
BTCPay Server retweeted
Through all the challenges & AI attacks the @BtcpayServer still continues to ship the updates & fixes!
Thanks to all of you reporting issues, opening PRs and testing new versions on your servers.
Onwards ✊🗽
BTCPay Server 2.4.6 is out! 🚨
Another security-focused release, bringing further hardening especially around our dependencies.
To update, go to Server Settings → Maintenance → Update, or run btcpay-update(.)sh from the command line after removing the parentheses.
Special thanks to our supporters: @spiral_xyz @OpenSats @tether @HRF @LunaNode @walletofsatoshi @CoinCards @ivpnnet @unbankworld
for sticking with us during these turbulent periods and allowing us to continue developing free and open source payment software for everyone 💚
Thank you to our contributors, reviewers, testers and everyone reporting issues. Special thanks to independent security researchersn @ProjectLoupe @premai_io @BugBunny_ai and @MagicGrants
for helping us make BTCPay Server stronger. 💚