BTCPay Server supporters are offering a bounty tied to the recovery of Bitcoin stolen in a recent exploit. In a post on X on Monday, BTCPay said it would pay 10% of any recovered funds, capped at 3 BTC, if all of the stolen Bitcoin is returned. Based on current prices cited by the project, that cap is worth about $190,000.
The offer extends to anyone with information that could help recover the funds, including the attacker.
“We will examine our mistakes, but regret alone will not help affected users or secure the project,” BTCPay wrote. “There is no time to waste. We have to learn, improve, and act quickly.”
Users were told to upgrade or take servers offline
BTCPay first warned users about the attacks on Friday, telling them to install version 2.4.2 or take their servers offline. At that stage, the project had not confirmed any thefts or explained how the exploit worked.
According to BTCPay, the flaw allowed attackers to obtain LND admin macaroons, credentials that give broad control over a Lightning Network node. Those credentials could then be used to access connected wallets.
The Lightning Network is a layer-2 payment network built on top of Bitcoin and is designed to support faster and cheaper transactions. Its nodes route payments through channels between users.
BTCPay has not disclosed the scale of losses
BTCPay has not said how much Bitcoin was stolen, how many users were affected, or whether any funds have been recovered so far.
If more than one tip contributes to the recovery, the bounty will be split in coordination with victims. The project said it would weigh each victim’s losses, the amount recovered, and the usefulness of each tip when deciding how to divide the reward.
Foundation to make two 0.21 BTC donations
The BTCPay Server Foundation said it will donate 0.21 BTC each to security researcher Craig Raw and the Bitcoin Red Team fund for responsibly disclosing the vulnerability.
“These are modest contributions, but they are what we can offer as a FOSS project and a way to appreciate people doing critical security work, which helps the entire ecosystem,” BTCPay wrote.
Security patches will take priority over new features
The company said it is strengthening code reviews and prioritizing security patches over new features as AI makes it easier for attackers to find vulnerabilities in Bitcoin software.
“Defending software in this environment requires better tools, more thorough reviews, faster security responses, and support for researchers who find and responsibly report vulnerabilities,” BTCPay wrote.