{
  "id": 539246,
  "title": "BTCPay offers $190,000 bounty after bitcoin payment servers drained in exploit",
  "url": "https://urgent.news/2026/08/11/btcpay-offers-190-000-bounty-after-bitcoin-payment-servers-drained-in",
  "topic": "finance",
  "section": "Finance & Markets",
  "published": "2026-08-11T06:19:07.000Z",
  "source": {
    "name": "CoinDesk",
    "slug": "coindesk",
    "url": "https://www.coindesk.com/markets/2026/08/11/btcpay-offers-usd190-000-bounty-after-bitcoin-payment-servers-drained-in-exploit"
  },
  "original_language": "en",
  "account": "Bitcoin payment processor BTCPay Server has announced a $190,000 bounty to recover stolen funds after an exploit last week. The company is offering 10% of any recovered funds, up to a maximum of 3 BTC. The bounty is open to anyone with information, including the attacker. BTCPay is asking for reports to be submitted to its security address, with secure channels available upon request. If multiple reports lead to a recovery, the bounty will be split among the victims based on the amount lost and the usefulness of the information provided.\n\nIn addition, BTCPay has donated 0.21 BTC to developer Craig Raw and the Bitcoin Red Team fund for their responsible security disclosure of the critical vulnerability. Hardware-wallet maker Foundation and bitcoin publication Citadel21 have also reported losing funds due to the exploit.\n\nThe vulnerability allowed attackers to obtain credentials for LND, the most widely used software for running a Lightning node, enabling them to drain associated wallets. Both BTCPay and the victims have not yet disclosed the total amount stolen.\n\nBTCPay and affected merchants have urged the public to report the theft to local law enforcement and any service the funds are traced to. The Bitcoin Red Team, a volunteer effort, has been actively pointing AI models at bitcoin codebases to find vulnerabilities, including the one that led to this patch. BTCPay advises merchants to keep funds in cold storage and regularly move excess out of hot wallets, especially during this period of rapid AI-driven change.",
  "summary": "The project said it will pay 10% of recovered funds, up to 3 BTC, after attackers stole LND credentials and drained merchant Lightning wallets last week.",
  "key_points": [
    "BTCPay Server offers $190,000 bounty to recover stolen funds",
    "Vulnerability allowed attackers to obtain LND credentials",
    "BTCPay and victims urge public to report theft to law enforcement"
  ],
  "editors_take": "The bounty offer signals BTCPay's prioritization of recovering stolen funds over traditional punitive measures, potentially setting a precedent for future exploit cases in the cryptocurrency sector.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}