BTCPay Server, an open-source payment processing platform, has publicly warned its users of a critical security vulnerability that is currently being actively exploited. The platform indicated that the exploit could potentially lead to the unauthorized drainage of user funds.

While the specific technical details of the vulnerability remain limited, the company’s advisory serves as an urgent call to action for administrators and users to secure their instances. The nature of the exploit suggests that attackers are targeting the payment infrastructure directly, though the company has not yet provided a comprehensive breakdown of how many users have been affected or the total value of assets at risk.

Security researchers and the BTCPay team are currently working to mitigate the threat. Users are advised to monitor official communication channels for patch releases or configuration updates necessary to close the security gap. Because the platform is self-hosted, the responsibility for applying these security measures falls primarily on the individual operators of the BTCPay instances rather than a centralized service provider. As of now, the primary focus remains on preventing further unauthorized access to payment gateways.