BTCPay Server Rushes Out Emergency Patch After Bitcoin Security Bug
Aug 8, 2026
BTCPay Server just pushed an emergency fix after devs found a bug that could let hackers slip past two-factor security tied to merchant accounts.
What happened
BTCPay Server, the open-source tool a ton of merchants use to accept Bitcoin, had to drop an emergency patch this week. Turns out there was a nasty bug hiding in its Greenfield API that let attackers get around the TOTP two-factor login check. Not great when we're talking about software that touches people's Bitcoin.
The issue got flagged and fixed through a GitHub pull request, and the team moved fast to close the hole before it could really be abused in the wild.
Why it matters
If you're running a store or business on BTCPay, this is your sign to update right now. Self-hosted Bitcoin payment tools are awesome for keeping control of your own money, but that control also means the security is on you. No exchange support line to call if something goes wrong.
Bugs like this are a good reminder that even solid, trusted open-source projects need constant eyes on them. Patch fast, stay safe, and keep an eye on your node.