BTCPay Server

Self-hosted Bitcoin payments. No middleman, no fees, no KYC.

btcpayserver.org

Zero KYC
Evidence and facts →

Self-hosted Bitcoin payments. No middleman, no fees, no KYC.

Common useMerchants accepting BTCMerchants / Privacy ToolsOperator dataHosted

Identity checksZero KYCNo document check recorded · identity exposure level 0/4

Evidence and riskPartial evidenceCautionSome material claims still need confirmation.; those sources show trade-offs worth reading.

Last reviewedReviewed 5 Sep 2026KYC checked 5 Sep 2026 · unknown jurisdiction · Source → official siteHow to cite this pageSource coveragePartial evidenceRecorded riskCaution

Evidence and facts

CUNICULA SCORE 4.0

76/100Limited evidencePrivacy 25/25 · Control 20/20 · Transparency 15/20 · Security 13/25 · Accountability 3/10 · Method

JURISDICTIONUnknown

INCIDENTThis is a security release; updating is recommended for servers shared with many users.
active · medium · since 2026-08-24
Upgrade to v2.4.3 or later, especially on shared multi-user servers; the release does not claim a confirmed compromise. This is a security release; updating is recommended for servers shared with many users.

AUDITED BYNo audit listed

OPERATOR DATAHosted operator recorded

SOURCE COVERAGE

Partial evidenceTHIRD-PARTY REPORTED1/4Reviewed 5 Sep 2026 · Source → official site

LAST CHECKED2026-08-27

LAST UPDATED2026-09-05

Specs

DOCUMENT CHECKNone recorded

IDENTITY EXPOSURELevel 0/4

KYC TRIGGERSNo KYC of any kind. You run the server. You control the keys.

FEEFree

CATEGORIESMerchants, Privacy Tools, Agent Money

COMMON USESMerchants accepting BTC, Self-sovereign payments, No-fee transactions

FEATURESSelf-hosted, Open source, Lightning, No processor fees, No software KYC, Non-custodial, Merchant payments, WooCommerce plugin

TORNot listed

REGIONSGlobal availability

Review analysis, source material, related services, and history

Agent payments

Spend controls and data exposure

Useful as a self-hosted invoice and merchant-payment rail for agent workflows. It avoids platform custody and KYC, but wallet funding, network history, server logs, and merchant order records still need separate controls.

Payment tools Compare Wallet risks

Current options

Self-hosted wallet paymentwallet payment · cited identity, limits, controls, recovery, and failure path

Protocols

Merchant APIManual

Autonomy1 / agent drafts

CustodySelf-custody

Approval

Human approvalPolicy engineWallet grant

Controls

APIDashboardManual approval

Limits

Spend limitsNo

Merchant lockYes

Category lockNo

Pause / closeYes

WebhooksYes

Privacy

SettlementCrypto / Lightning

FundingSelf-hosted wallet

IdentityNo identity claim

Logging riskMedium

RevocationStrong

The safer pattern is agent-drafts, operator-or-policy-signs. Do not put seed material or broad wallet keys in the same runtime that browses, prompts, or receives untrusted task input.

Where payment data goes

1AI agent
2approval wallet or operator
3BTCPay Greenfield API invoice
4self-hosted BTCPay server
5Bitcoin or Lightning network
6merchant order record

Sources

About

Self-hosted open-source Bitcoin and Lightning payment processor that is non-custodial and charges no fees.

Analysis

OVERVIEW

A self-hosted payment processor: merchants accept Bitcoin and Lightning directly to their own keys, with no fees, no intermediary, and no KYC anywhere in the architecture.

LIMITS

Self-hosting is the cost: server operations, key management, and uptime fall on the merchant, and using a third-party host reintroduces exactly the intermediary the software removes.

USEFUL FOR

Merchants who want direct crypto acceptance and are prepared to run infrastructure for it.

Sources · reviewed 2026-07-16

BTCPay Server documentation ↗

We wrote about this

BTCPay Server 2.4.2: The Lightning Credential Incident

Frequently Asked Questions

Is identity verification required?

No identity verification is recorded for typical use. No KYC of any kind. You run the server. You control the keys.

Which payment methods are accepted?

Please check the provider site for accepted payment methods.

Where is it available?

Recorded availability: GLOBAL.

Is the operator based in a Five Eyes country?

The jurisdiction is not publicly confirmed. Check the provider site for incorporation details.

How are identity, operator, and evidence fields reported?

Identity exposure is level 0 of 4. A hosted operator is recorded. Jurisdiction is shown as context, not a safety verdict. Source coverage is partial evidence, last reviewed 2026-09-05, and recorded risk is caution.

Related Services

addy.ioaddy.ioaddy.io · Email · GB

Email aliasing, self-hostable, crypto accepted.

Cunicula score68/100Source coverageCurrent Zero KYCCaution

About Visit ↗

Anon Shopanonshop.appanonshop.app · Merchants · ??

Monero proxy shopping for Amazon and eBay.

Cunicula scoreNot ratedSource coveragePartial Zero KYCCaution

About Visit ↗

Aztecoazte.coazte.co · Gift Cards · US

Bitcoin vouchers bought with cash in 190+ countries.

Cunicula scoreNot ratedSource coveragePartial Light KYCCaution

About Visit ↗

Compare

Compare withFlexaKYC, privacy, evidence, risk, fees, limits, jurisdiction, audits, and features.

Compare withProxyStoreKYC, privacy, evidence, risk, fees, limits, jurisdiction, audits, and features.

Compare withSHOPINBITKYC, privacy, evidence, risk, fees, limits, jurisdiction, audits, and features.

Sources and history

Service history

Latest meaningful changes to the facts shown on this provider page.

5 Sep 2026
Review overdue providers against current sources
Features, Jurisdiction, Jurisdiction confidence, KYC last checked, and 4 more
26 Aug 2026
Apply full-service rereview and score 4.0
Privacy warning, Recorded risk, Score assessment
9 Aug 2026
Corporate registry information updated
Corporate / Entity type

Full service history

5 Sep 2026updated
Review overdue providers against current sources
Features
Self-hosted, Open source, Lightning, No fees, No KYC, Non-custodial, Merchant payments, WooCommerce plugin, Shopify pluginSelf-hosted, Open source, Lightning, No processor fees, No software KYC, Non-custodial, Merchant payments, WooCommerce plugin
Jurisdiction
JPnot set
Jurisdiction confidence
inferredunknown
KYC last checked
2026-03-132026-09-05
Last reviewed
2026-07-052026-09-05
Privacy warning
Self-hosted and non-custodial, but all versions before 2.4.2 exposed LND admin macaroon credentials; attackers exploited the flaw and stole funds. LND operators must update to current BTCPay Server/LND, rotate or regenerate credentials, and review node activity.BTCPay Server versions before 2.4.2 exposed LND macaroon credentials to unauthenticated remote access, and attackers exploited the flaw to steal funds. Only LND deployments were exposed; built-in on-chain wallets were not affected. Update to a current release, regenerate or rotate credentials, and inspect node activity. Separately managed LND exposure paths need manual credential rotation.
Source reviewed
older source, not independently verifiedhttps://blog.btcpayserver.org/security-advisory-btcpay-server-2-4-2/
Updated at
2026-03-132026-09-05
Review source: official site · public history entry
27 Aug 2026updated
Reconcile score 4.0 evidence
Checked at
2026-06-242026-08-27
Score assessment / Operator data exposure
limitednone
Score assessment / Source model
openopen-reproducible
Score review
not setOutcome: HOLD; Checked at: 2026-08-27; Inputs: Operator data exposure: none; Control model: local-self-custody; Source model: open-reproducible; Audit: Score eligible: no; Reason: Security policy exists, but no current complete independent audit report with date/scope was established.
Review source: older source, not independently verified · public history entry
26 Aug 2026updated
Apply full-service rereview and score 4.0
Privacy warning
not setSelf-hosted and non-custodial, but all versions before 2.4.2 exposed LND admin macaroon credentials; attackers exploited the flaw and stole funds. LND operators must update to current BTCPay Server/LND, rotate or regenerate credentials, and review node activity.
Recorded risk
standardcaution
Score assessment
not setOperator data exposure: limited; Control model: local-self-custody; Source model: open
Review source: older source, not independently verified · public history entry
10 Aug 2026updated
Add option-level directory
Categories
Merchants, Privacy ToolsMerchants, Privacy Tools, Agent Money
Review source: older source, not independently verified · public history entry
9 Aug 2026updated
Corporate registry information updated
Corporate / Entity type
not setunresolved
Review source: older source, not independently verified · public history entry
8 Aug 2026updated
Corporate registry information updated
Corporate
not setOfficers: none; Prior entities: none
Review source: older source, not independently verified · public history entry
8 Aug 2026updated
Provider summary rewritten
Description
Self-hosted, open source Bitcoin and Lightning payment processor. Free, no fees, no KYC, non-custodial. Run on your own server or use a third-party host.Self-hosted open-source Bitcoin and Lightning payment processor that is non-custodial and charges no fees.
Review source: older source, not independently verified · public history entry
7 Aug 2026updated
Provider summary rewritten
Card summary
not setSelf-hosted Bitcoin and Lightning payments.
Review source: older source, not independently verified · public history entry
6 Aug 2026updated
Make service ratings transparent
Evidence status
verifiedpartial
Review source: older source, not independently verified · public history entry
6 Aug 2026updated
Provider presentation updated
Evidence status
not setverified
Recorded risk
not setstandard
Trust level
verifiednot set
Review source: older source, not independently verified · public history entry
5 Jul 2026updated
Clear freshness review queue
Last reviewed
2026-03-132026-07-05
Review source: older source, not independently verified · public history entry
5 Jul 2026updated
Harden agent money privacy lane
Agent money / Mandate logging risk
not setmedium
Agent money / Revocation quality
not setstrong
Agent money / Source links
not setLabel: BTCPay Server homepage; Href: https://btcpayserver.org/; Scope: provider, Label: BTCPay Greenfield API; Href: https://docs.btcpayserver.org/API/Greenfield/v1/; Scope: controls, Label: BTCPay wallet docs; Href: https://docs.btcpayserver.org/Wallet/; Scope: custody
Review source: older source, not independently verified · public history entry
5 Jul 2026updated
Expand agent money privacy surface
Agent money / Authorization model
not sethuman-approval, policy-engine, wallet-grant
Agent money / Autonomy level
not set1
Agent money / Custody model
not setself-custody
Agent money / Protocol privacy notes
not setThe safer pattern is agent-drafts, operator-or-policy-signs. Do not put seed material or broad wallet keys in the same runtime that browses, prompts, or receives untrusted task input.
Agent money / Protocols
not setmerchant-api, manual
Agent money / Settlement rail
not setcrypto, lightning
Review source: older source, not independently verified · public history entry
4 Jul 2026updated
Provider facts reviewed and updated
Agent money
not setCompatible: yes; Control surfaces: api, dashboard, manual; Spend limits: no; Merchant lock: yes; Category lock: no; Pause close: yes; Transaction webhooks: yes; Funding source: self-hosted; Identity surface: none; Data path: AI agent, approval wallet or operator, BTCPay Greenfield API invoice, self-hosted BTCPay server, Bitcoin or Lightning network, merchant order record; Notes: Useful as a self-hosted invoice and merchant-payment rail for agent workflows. It avoids platform custody and KYC, but wallet funding, network history, server logs, and merchant order records still need separate controls.
Review source: older source, not independently verified · public history entry
24 Jun 2026updated
Provider facts reviewed and updated
Checked at
2026-03-132026-06-24
Review source: older source, not independently verified · public history entry
22 Jun 2026updated
Ship trust audit remediation pass
Jurisdiction confidence
not setinferred
KYC last checked
not set2026-03-13
Last reviewed
not set2026-03-13
Source reviewed
not setolder source, not independently verified
Review source: older source, not independently verified · public history entry
7 Apr 2026updated
Drop warrantCanary trust signal
Warrant canary
nonot set
Review source: source not recorded · public history entry
29 Mar 2026updated
KYC risk level system + advanced directory filters
KYC level
zero0
Review source: source not recorded · public history entry
14 Mar 2026updated
Offline status bug, vetted grid, news/projects img tags
Status
liveok
Review source: source not recorded · public history entry
14 Mar 2026created
Provider presentation updated
Provider profile
not setcreated
Review source: source not recorded · public history entry

Only fields shown on the provider page are tracked. Private identifiers are never published.

Evidence basis: Claims on this page are linked to published sources for comparison, not certification, audit, endorsement, or recommendation; read the methodology and coverage map before relying on an entry.