An emergency update has been rolled out by BTCPay Server, the open-source software merchants use to accept Bitcoin, due to a vulnerability being exploited to potentially steal funds from users.
As identified in GitHub pull request #7491, this vulnerability enables cybercriminals to circumvent the TOTP two-factor security mechanism through BTCPay’s Greenfield API Basic Authentication. The reason for the vulnerability lies in the fact that the authentication mechanism checked whether valid FIDO2 credentials were registered rather than actually checking whether the two-factor system was even enabled. Thus, the accounts secured with a TOTP authenticator application could access the API using only their email and credentials.
It is important to note that the vulnerability exists within the application layer of BTCPay, not in the Bitcoin (BTC) protocol.
BTCPay has launched version 2.4.2 of its software on August 7 while also advising users to make sure they have updated to the version 2.6.10 of NBXplorer. The upgraded software addresses a “critical vulnerability” that is currently being exploited.
A market that shrugged at the payments scare
Despite the ongoing security concern plaguing the payment system, Bitcoin’s market price and valuation are relatively stable. Bitcoin is trading at about $64,889, which is just a 0.82% increase from the previous day, while its $1.3 trillion market cap has seen a rise of only 0.79%. Even though trading activity has been more active with the 24-hour volume increasing 20.98%, the fairly stable price and market cap indicate that the incident has not yet had an impact on Bitcoin’s overall market valuation.
The subdued response is understandable. The BTCPay vulnerability affects only individual merchants and operators, not Bitcoin’s consensus rules or cryptography.
However, that does not mean it is insignificant. BTCPay creates a link between the Bitcoin network and the payment systems of businesses issuing invoices, receiving payments and managing the wallets. Therefore, in case of an attack on the operator account, it becomes possible to cause real monetary losses despite the proper functioning of the Bitcoin blockchain.
What BTCPay told operators to do
The immediate solution to this problem is simple: upgrade BTCPay Server to version 2.4.2 and, for integrators, upgrade NBXplorer to version 2.6.10.
According to BTCPay, it is better to use application programming interface (API) keys instead of Basic Authentication because permissions can be limited more effectively. The new patch has also introduced changes to the authentication process so that it will be able to check whether 2FA is really active, thereby closing the gap which enabled TOTP-protected accounts to avoid the second authentication level.
Since BTCPay is self-hosted, operators cannot depend on a central provider to implement the patch for them.
A third strike for Bitcoin’s payment plumbing
BTCPay’s announcement comes after a tumultuous week for Bitcoin’s payment system. Cryptopolitan had reported earlier that ZEUS, the provider of a Lightning wallet, had rendered its payment infrastructure inactive because of a problem that occurred involving the security of the system, while other Lightning service providers also got affected.
The occurrences do not indicate that the Bitcoin payment protocols are failing in any way. They do show, however, how much additional security risk is introduced by the software built around the blockchain.
A 2024 study by researchers from Northeastern University and TU Delft used formal modeling to identify security problems in Lightning’s single-hop payment protocol, including a new “Payout Race” attack.
