On Friday, the Bitcoin payment service BTCPay Server warned users that a critical vulnerability is being exploited by attackers, posing a risk of unauthorized access and fund loss. The project recommends users upgrade immediately; if an update cannot be applied promptly, users should shut down their servers.
Users must immediately update and rotate their credentials.
BTCPay advises that, in addition to updating the system, users should replace the authentication credentials known as macaroons, rebuild the macaroons.db file, and refresh the authentication strings used by other Lightning Network backends.
If a user previously generated an on-chain hot wallet within BTCPay, the project recommends transferring the funds immediately and recreating the wallet. This means the risk extends beyond mere backend access and may also affect assets directly managed by the server.
- Update BTCPay Server immediately
- Turn off the server before attempting to update.
- Replace the macaroons and rebuild the authentication files.
The vulnerability details have not been disclosed.
BTCPay credited the discovery of this vulnerability to members of the Bitcoin Red Team, but did not disclose the vulnerability's mechanism, when the attack began, how many servers were affected, or whether any actual funds have been lost.
When a vulnerability is still actively being exploited, project teams typically delay disclosing technical details to prevent further expansion of the attack surface. At this stage, the most important action for users is to complete isolation, updates, and credential rotation.
Recent incidents have mentioned AI-assisted vulnerability discovery.
BTCPay did not specify whether AI tools were involved in this attack. However, in recent cryptocurrency security incidents, AI is increasingly being used to identify vulnerabilities.
In May, security researcher Taylor Hornby used Anthropic’s Claude Opus to uncover a four-year-old vulnerability in Zcash; in August, hardware wallet provider Coinkite also indicated that attackers may have used AI to identify firmware flaws related to over $100 million in stolen bitcoins. This past Tuesday, Bitcoin exchange service Boltz suspended operations due to repeated exploits, stating that AI-assisted attacks are discovering vulnerabilities faster than their team can patch them.