BTCPay Server

BTCPay Server began in August 2017. On September 14, 2019, the project announced an independent foundation and its first grant from Square Crypto to support contributors. The foundation neither owns nor controls the project and does not commercialize it.⁠[2]

BTCPay Server began releasing its Greenfield API in 2020 alongside an older interface largely compatible with BitPay’s API for merchant migration.⁠[3]

Released on October 29, 2024, version 2.0 reorganized the internal architecture and added full back-office localization, sidebar navigation and onboarding changes. It expanded Wix, Odoo and BigCommerce integrations, while API changes required some custom plugins to be updated.⁠[4]

A jointly authored November 2024 case study stated that NamecheapNamecheapNamecheap is a US domain registrar and web services company founded by Richard Kirkendall in 2000. Its products include domains, hosting, email, and security services.Open the full entry processed approximately 1.1 million BitcoinBitcoinBitcoin (common symbol BTC) is an open peer-to-peer electronic cash protocol, network, and native digital asset. Full nodes independently verify transactions and blocks according to the consensus rules; transactions are recorded as UTXOs, and blocks are organized into a public ledger through proof of work. Bitcoin is not issued or managed by any single institution, but using, holding in custody, and trading it still involve key, privacy, market, and legal risks.Open the full entry transactions and over $73 million in revenue between its May 2020 integration and October 2024. These were merchant figures, not revenue of the BTCPay project.⁠[5]

Version 2.1.0, released April 10, 2025, redesigned the multisignature wallet interface and improved RBF and CPFP fee-acceleration tools. Zcash and Monero support moved into separate plugins, alongside new Shopify V2, Ghost and Ecwid integrations.⁠[6]

On July 31, 2025, version 2.2.0 expanded report metadata, exchange-rate records and multicurrency accounting while improving coin selection and address management. It also introduced a public Plugin Builder, Miniscript support, Lightning liquidity-service tooling and GiveWP integration.⁠[7]

Version 2.3.0 introduced native subscriptions on December 18, 2025, using payments each billing period or deductions from prepaid balances. Server operators could charge users subscriptions for hosting services while the open-source software itself remained free.⁠[8]

Released June 25, 2026, version 2.4.0 introduced global search, passkey login and guided multisignature wallet setup. It separated permissions for viewing, signing and broadcasting transactions, with corresponding controls in the Greenfield API.⁠[9]

On August 7, 2026, the project released security update 2.4.2 after confirming thefts involving a remotely exploitable vulnerability exposing LND access credentials. Its standard Docker deployment also rotated credentials and disabled default public access to the LND API.⁠[10]

A September 8 notice disclosed an intrusion into the self-hosted Plugin Builder detected on September 2. The team rotated access tokens and paused registration and builds. It said developers’ email addresses were likely exposed but found no attempt to maliciously replace published plugins.⁠[11]

The October 5 announcement for 2.4.5 strengthened Lightning and LNURL security, made Tor opt-in and removed unmaintained integrations. Plugin Builder reopened registration and builds, using isolated temporary sandboxes and validating build output.⁠[12]

Released October 29, 2026, version 2.4.7 fixed 85 scan findings involving payouts, checkout, account security and other areas. Its notes credited AnthropicAnthropicAnthropic is an artificial intelligence research and product company founded in 2021 that develops the Claude models, assistant, and tools such as Claude Code, and operates as a public benefit corporation. Dario Amodei and Daniela Amodei are its co-founders, and its research covers model safety, interpretability, and steerability.Open the full entry’s OSS Scanner for reproductions and proposed fixes. The finding count does not represent a count of exploited incidents or losses.⁠[13]

A November 2 notice confirmed Bitcoin and Litecoin thefts from hot wallets on versions 2.4.1 and earlier through a different exploitation method for the vulnerability fixed in August. The project saw no impact on servers already running 2.4.2 or later before its November 1 warning and advised affected older installations to move to fresh servers and wallets.⁠[14]

Nicolas Dorier founded BTCPay Server. Its independent foundation uses donations to support development, documentation, plugins and outreach. Its stated governance rules give Dorier an additional deciding vote when custodians are deadlocked.⁠[15]

Users can deploy BTCPay Server on their own infrastructure or choose third-party hosting, and one instance can serve multiple stores. Deployment options differ in maintenance, support and cost: free software does not eliminate infrastructure, network or operational expenses.⁠[16]

Invoices fix the requested amount and exchange rate for a limited period and track payment and settlement states. On-chain payments may await confirmations, while Lightning payments normally settle without them. Refund claim links collect payout destinations for merchant review and processing.⁠[17]

With an existing wallet, BTCPay Server can derive receiving addresses from an extended public key without holding spending keys. Server-generated hot wallets store private keys, while Lightning connections involve access credentials; exposure therefore depends on the configuration.⁠[3]