We self-host BTCPay Server to accept Bitcoin payments so no third party sees who pays us.
On 7 August a critical BTCPay vulnerability was exploited to steal Bitcoin from our Lightning node.
The funds were ours: no customer data accessed, no customer funds lost, no action needed. The server keeps no request logs, so no payment records were exposed.
We sent btcpayserver (npub155m…dcvg) a report on the incident.
Details: https://www.ivpn.net/blog/security-incident-bitcoin-payment-server/
IVPN on Nostr
npub1wl…5zy3z
2026-08-11 14:10:27 UTC
Author Public Key
npub1wlx4wqeyzzspw43gk56hlfj4k8ava262let5wvammn8djwx7jx3qp5zy3zSeen on
wss://relay.mostr.pubPublished at
2026-08-11 14:10:27 UTCEvent JSON
{
"id": "79171faaf3550bd5da6e5c7819d42f4b30835c977f9c9d58f1ad9313bd7e0470",
"pubkey": "77cd57032410a0175628b5357fa655b1faceab4afe574733bbdcced938de91a2",
"created_at": 1786457427,
"kind": 1,
"tags": [
[
"p",
"a536ab1f7f3c0133baadbdf472b1ac7ad4b774ed432c1989284193572788bca0"
]
],
"content": "We self-host BTCPay Server to accept Bitcoin payments so no third party sees who pays us. \n\nOn 7 August a critical BTCPay vulnerability was exploited to steal Bitcoin from our Lightning node.\n\nThe funds were ours: no customer data accessed, no customer funds lost, no action needed. The server keeps no request logs, so no payment records were exposed.\n\nWe sent nostr:npub155m2k8ml8sqn8w4dhh689vdv0t2twa8dgvkpnzfggxf4wfughjsq2cdcvg a report on the incident.\n\nDetails: https://www.ivpn.net/blog/security-incident-bitcoin-payment-server/",
"sig": "34eb6c68de3ee502dd0deb75d857c02c1232636b7cb1ebc22faa2a92c50abd7945c324673dd26ed6b381e643918e3f9777a35c910f95e53104142b07148fb6c9"
}