BTCPay Server supporters are offering 10% of any funds recovered, capped at 3 BTC currently worth around $190,000, if all the Bitcoin stolen in a recent exploit is returned.
In a post on X on Monday, BTCPay said the offer extends to anyone with information that could help recover the funds, including the attacker.
“We will examine our mistakes, but regret alone will not help affected users or secure the project,” the company wrote. “There is no time to waste. We have to learn, improve, and act quickly.”
BTCPay first warned users about the attacks on Friday, urging them to install a new version, 2.4.2, or take their servers offline. At the time, the project had not confirmed any thefts or explained how the exploit worked.
According to BTCPay, the flaw allowed attackers to obtain LND admin macaroons—credentials that grant broad control over a Lightning Network node—and use them to access connected wallets. The Lightning Network is a layer-2 payment network built on the Bitcoin blockchain that enables faster and cheaper transactions. Lightning Network nodes route payments through channels between users.
BTCPay has not disclosed how much Bitcoin was stolen, how many users were affected, or whether any funds have been recovered.
If multiple tips help recover the funds, the bounty will be divided in coordination with victims. The project said it would consider each victim’s losses, the amount recovered, and the usefulness of each tip.
The BTCPay Server Foundation will also donate 0.21 BTC each to security researcher Craig Raw and the Bitcoin Red Team fund for responsibly disclosing the vulnerability.
“These are modest contributions, but they are what we can offer as a FOSS project and a way to appreciate people doing critical security work, which helps the entire ecosystem,” BTCPay wrote.
The company said it is strengthening code reviews and prioritizing security patches over new features as AI is making it easier for attackers to find vulnerabilities in Bitcoin software.
“Defending software in this environment requires better tools, more thorough reviews, faster security responses, and support for researchers who find and responsibly report vulnerabilities,” BTCPay wrote.
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。
