BTCPay Server is offering a bounty worth up to 3 BTC for information that helps recover bitcoin stolen from merchant Lightning wallets. The exploit involved LND credentials and affected users including Foundation and Citadel21, according to CoinDesk.
BTCPay Server is offering a bounty worth up to 3 BTC for information that helps recover bitcoin stolen from merchant Lightning wallets. The exploit involved LND credentials and affected users including Foundation and Citadel21, according to CoinDesk.
BTCPay Server said Tuesday it is backing a recovery bounty after attackers exploited a vulnerability last week to steal bitcoin from merchant payment servers. The project is offering 10% of any recovered funds, capped at 3 BTC, which CoinDesk reported was worth about $190,000 at current prices.
BTCPay Server said Tuesday it is backing a recovery bounty after attackers exploited a vulnerability last week to steal bitcoin from merchant payment servers. The project is offering 10% of any recovered funds, capped at 3 BTC, which CoinDesk reported was worth about $190,000 at current prices.
The incident matters because BTCPay is used by merchants to accept bitcoin payments, and the exploit targeted infrastructure tied to Lightning wallets. According to the report, attackers were able to obtain credentials for LND, widely used software for operating a Lightning node, and drain wallets connected to those credentials.
BTCPay said the bounty is open to anyone who provides useful information, including the attacker. If multiple reports contribute to a recovery, the payout would be split based on victims’ losses and the usefulness of the information, CoinDesk reported.
The known affected parties include hardware-wallet maker Foundation and bitcoin publication Citadel21, both of which reported lost funds. BTCPay and the victims had not disclosed a total amount stolen at the time of the report.
BTCPay has also said exchanges, blockchain analytics firms and law enforcement are helping trace the funds. The project urged affected merchants to report losses to local police and to any service where stolen funds are traced, while advising merchants to keep most holdings in cold storage and move excess balances out of hot wallets regularly.
The vulnerability was identified by researchers connected to the volunteer Bitcoin Red Team, which has been using AI tools to scan bitcoin projects for bugs. BTCPay said it is donating 0.21 BTC each to developer Craig Raw and to the Bitcoin Red Team fund for responsible disclosure.
Keep exploring
Brazil’s central bank will require exchanges to delay certain crypto transfers abroad and to self-custody wallets for up to 24 hours. The rule, set to take effect on Jan. 1, 2027, applies to transfers above $10,000 and smaller transactions flagged as risky.
Read
US spot Bitcoin ETFs drew $1 billion in weekly inflows, marking their strongest week since April. The performance was described as the third-strongest since October, pointing to renewed institutional momentum.
Read
A volunteer Bitcoin security initiative says it has scanned 150 repositories and disclosed more than a dozen vulnerabilities. The group is also building an open-source AI platform designed to automate software security reviews.
Read