BTCPay Server operators using the software’s standard Docker deployment will need to make an explicit configuration choice at their next setup or update if they want to keep access through Tor onion services.
The change arrived with BTCPay Server version 2.4.5. BTCPay announced the deployment adjustment on Oct. 5, while the official GitHub release page lists version 2.4.5 as released on Oct. 6. According to CryptoSlate, the update removes Tor from the components automatically included in the Docker deployment and makes it an optional addition selected by the administrator.
What Docker operators need to do
The change affects existing installations at their next Docker setup or update. Administrators who depend on Tor for onion access will need to add the optional Tor fragment after moving to version 2.4.5. BTCPay’s command for enabling it is:
- sudo btcpay-fragments add opt-add-tor
The command requires root access and reapplies the setup immediately. The opt-add-tor fragment adds hidden services and selected onion connectivity. Operators can use btcpay-fragments show to inspect the saved additional and excluded fragments, as well as the effective fragments recorded in the latest generated manifest. That inspection command does not alter the configuration.
BTCPay says existing Tor data remains in the current Tor volumes. This means stored data is preserved, but continued onion access still depends on Tor being included and running in the deployment. Tor is therefore still supported; the change concerns how it is selected during deployment.
Version 2.4.5 also changes private-network requests
The release includes a separate security-related change affecting outbound HTTP requests. By default, destinations on private networks are blocked for Lightning connections, LNURL requests, invoice notification URLs and webhooks.
The restriction is designed to help prevent server-side request forgery, commonly called SSRF. In this type of attack, a server can be manipulated into sending requests to destinations that should not be reachable through an exposed service.
Operators that intentionally connect BTCPay to private services must create exceptions through the ssrfexceptions setting while the protection remains enabled. BTCPay’s operator guidance says the application should be restarted after changing the setting, followed by a test of the integration involved.
Market picture
Moneyiar market data at 11:54 a.m. on Oct. 11, 2026, showed Bitcoin at $83,063.44, up 0.30% over 24 hours but down 2.61% over seven days. Plasma (XPL) was $0.08710, up 0.27% in 24 hours and down 8.31% over seven days.
Nexus (NEX) traded at $0.0000008112, rising 2.29% over 24 hours and falling 1.32% over seven days. Data Network (DATA) stood at $0.1948, up 0.18% on the day and down 7.24% over the week.
For BTCPay administrators, the immediate issue is operational rather than a change to Bitcoin’s market price: deployments that previously received Tor automatically must be reviewed before their next update, while private-network integrations may also require explicit exceptions.
