BTCPay Server Offers $190,000 Bounty After Lightning Wallet Exploit

BTCPay Server announced it will offer a bounty of 10% of any recovered stolen bitcoin, capped at 3 BTC, worth roughly $190,000 at current prices, to anyone who provides information leading to the return of funds stolen from merchants last week. The offer extends to anyone with useful information, including the attacker responsible, with the project encouraging people to reach out through its security channels.

Attack Exploited Lightning Node Vulnerability

The exploit involved attackers obtaining credentials for LND, the most widely used software for running Lightning nodes, which allowed them to drain associated merchant wallets. Hardware wallet maker Foundation and bitcoin publication Citadel21 both confirmed losing funds in the incident, though a full total of stolen funds has not yet been published by BTCPay or the affected parties.

Researchers Also Rewarded

Alongside the bounty, BTCPay Server said it is donating bitcoin to the security researchers who responsibly disclosed the vulnerability, including independent developer Craig Raw and the Bitcoin Red Team, as recognition for identifying the critical flaw before it could cause further damage. If multiple tips lead to a successful recovery, the reward will be divided among contributors and affected victims based on their losses and the value of the information provided.