- BTCPay offers 10% of recovered funds, with the bounty capped at 3 BTC.
- Attackers used exposed LND administrator credentials to drain Lightning wallets.
- Craig Raw and Bitcoin Red Team will each receive 0.21 BTC for disclosure.
BTCPay Server supporters have funded a bounty aimed at recovering Bitcoin stolen from merchants during last week’s security breach. The reward equals 10% of recovered funds and carries a maximum payout of 3 BTC. The project opened the offer to anyone with useful information, including the attacker. Victims have reported drained Lightning wallets, although total losses remain undisclosed.
BTCPay Server Bounty Seeks Recovery of Stolen Bitcoin
The BTCPay Server recovery program will reward information that directly helps return stolen funds. Contributors can contact the project’s security team, which also offers secure communication channels.
If several reports help recover funds, the project will divide the bounty among contributors and victims. Payments will reflect each victim’s losses and the value of information provided.
The BTCPay Server bounty follows reports from Foundation and Citadel21 that attackers emptied their Lightning nodes. Exchanges, blockchain analytics companies and law enforcement agencies have also offered support with tracing the stolen Bitcoin.
BTCPay has asked affected merchants to report thefts to local authorities. Users should also contact services where investigators trace stolen funds.
BTCPay Server Fix Addresses Critical LND Credential Flaw
The attack targeted a flaw affecting BTCPay Server versions released before version 2.4.2. Attackers could obtain LND administrator macaroon credentials from exposed installations.
Those credentials can provide broad access to connected Lightning wallets. The vulnerability did not expose BTCPay on-chain wallets through the same attack route.
The final BTCPay Server 2.4.2 release fixed the LND vulnerability. The project urged affected operators to upgrade immediately.
BTCPay is also rewarding the researchers who privately reported the flaw. Sparrow Wallet developer Craig Raw and the Bitcoin Red Team will each receive 0.21 BTC.
The BTCPay Server team is preparing a full postmortem. It is also adding stronger code-scanning and review procedures with outside security groups.
Disclaimer: This article is for informational purposes only and does not constitute financial advice. CoinCryptoNewz is not responsible for any losses incurred. Readers should do their own research before making financial decisions.
