$190K Bounty Offered After Exploit Targets BTCPay Bitcoin Payment Servers

BTCPay Server has put up a bounty of as much as 3 BTC, approximately $190,000, for information that helps recover bitcoin taken from merchants in last week’s exploit.

The Bitcoin payments platform said Tuesday that it will pay 10% of the funds successfully retrieved, with the reward capped at 3 BTC. The offer is open to anyone who can provide information that helps trace or recover the assets, including the attackers.

People with relevant information can contact BTCPay through its security channel, with secure communication options available upon request.

If multiple sources provide leads that contribute to a recovery, the bounty will be shared among victims. BTCPay said the distribution will reflect each victim’s losses as well as the usefulness of the information supplied.

The project is also supporting the researchers who uncovered the vulnerability. It plans to donate 0.21 BTC each to developer Craig Raw and the Bitcoin Red Team for their responsible disclosure.

The flaw was exploited last week to obtain LND credentials, giving attackers access to Lightning Network wallets operated through affected nodes. The compromised credentials were then used to drain bitcoin from merchant wallets.

Hardware-wallet company Foundation and Bitcoin publication Citadel21 have both confirmed that they were among the victims. Neither BTCPay nor the affected organizations has disclosed the total amount stolen.

BTCPay said cryptocurrency exchanges, blockchain analytics firms and law enforcement agencies are helping follow the stolen funds. Affected merchants have been urged to report the theft to local police and alert any platforms that receive or interact with the stolen bitcoin.

The Bitcoin Red Team is a volunteer security group that has been examining Bitcoin software with the help of AI models. The group has identified thousands of potential security issues across hundreds of projects, including the vulnerability addressed by BTCPay’s latest patch.

BTCPay has also urged merchants to improve wallet security by keeping funds in cold storage and regularly transferring excess balances away from hot wallets. The project said these measures are especially important as AI-assisted development continues to accelerate changes in the security landscape.