BTCPay Server warned on August 7, 2026, that a critical vulnerability in its self-hosted Bitcoin payment software is under active exploitation and can result in the loss of funds. Key TakeawaysBTCPay Server says attackers are actively exploiting a critical flaw that can steal funds from merchant-run payment servers. BTCPay Server issued the alert through its official X account, describing the flaw as critical and confirming that exploitation is already underway. “There is a critical vulnerability being actively exploited on BTCPay Server, which can result in the loss of funds,” the project said. A Widening Bitcoin Security ReviewThe warning lands during a broader security push across Bitcoin infrastructure.