BTCPay Server 2.4.7 Patches 85 Security Issues Following Major Vulnerability Review

BTCPay Server has released version 2.4.7, addressing 85 security findings and strengthening protections for businesses accepting Bitcoin payments. The October 29 update targets vulnerabilities affecting payment processing, authentication, and merchant account security.

The release comes amid heightened security concerns for self-hosted cryptocurrency payment infrastructure. On November 2, BTCPay Server also confirmed Bitcoin and Litecoin thefts involving outdated installations, increasing pressure on merchants to review their systems.

BTCPay Server Addresses Critical Security Vulnerabilities

According to the project’s official release notes, version 2.4.7 resolves 85 findings identified through Anthropic’s OSS Scanner program. These include one critical vulnerability, 13 high-severity issues, 52 medium-severity findings, and 19 low-severity problems.

The security improvements cover several important components of the payment platform. Developers strengthened payout restrictions, invoice access controls, two-factor authentication, and API permissions to reduce unauthorized activity.

Additionally, the update addresses weaknesses involving checkout forms and merchant account isolation. These changes are particularly important for service providers hosting multiple businesses on shared infrastructure.

BTCPay Server urged administrators to install the update promptly, especially when several merchants share the same installation.

Bitcoin Wallet Thefts Increase Security Concerns

The security release gained additional significance after BTCPay Server disclosed cryptocurrency thefts affecting older software versions.

On November 2, developers confirmed that attackers had targeted installations running version 2.4.1 or earlier. The attacks involved a vulnerability previously addressed in version 2.4.2, released in August.

However, developers reported no observed impact from these attacks on servers already running version 2.4.2 or later when the November 1 warning appeared.

The project also clarified that updating compromised installations may not eliminate existing unauthorized access. Operators of affected systems should migrate to fresh servers, replace potentially exposed credentials, and establish new wallets.

Self-Hosted Merchants Face Greater Security Responsibilities

BTCPay Server allows businesses to accept cryptocurrency payments without relying on traditional payment processors. However, this independence also places software maintenance and infrastructure security directly under merchant control.

For businesses handling customer transactions, delayed updates can expose sensitive information and increase financial risks. Administrators should therefore maintain reliable backups, monitor suspicious activity, and limit funds stored in internet-connected wallets.

The latest developments highlight a broader challenge facing cryptocurrency payment infrastructure. As digital asset adoption expands, consistent security maintenance remains essential for protecting merchant funds and preserving customer confidence.