BTCPay offers $190,000 bounty after bitcoin payment servers drained in exploit

Bitcoin payment processor BTCPay Server has announced a $190,000 bounty to recover stolen funds after an exploit last week. The company is offering 10% of any recovered funds, up to a maximum of 3 BTC. The bounty is open to anyone with information, including the attacker. BTCPay is asking for reports to be submitted to its security address, with secure channels available upon request.

If multiple reports lead to a recovery, the bounty will be split among the victims based on the amount lost and the usefulness of the information provided.

In addition, BTCPay has donated 0.21 BTC to developer Craig Raw and the Bitcoin Red Team fund for their responsible security disclosure of the critical vulnerability. Hardware-wallet maker Foundation and bitcoin publication Citadel21 have also reported losing funds due to the exploit.

The vulnerability allowed attackers to obtain credentials for LND, the most widely used software for running a Lightning node, enabling them to drain associated wallets. Both BTCPay and the victims have not yet disclosed the total amount stolen.

BTCPay and affected merchants have urged the public to report the theft to local law enforcement and any service the funds are traced to. The Bitcoin Red Team, a volunteer effort, has been actively pointing AI models at bitcoin codebases to find vulnerabilities, including the one that led to this patch. BTCPay advises merchants to keep funds in cold storage and regularly move excess out of hot wallets, especially during this period of rapid AI-driven change.