BTCPay Server has announced a bounty of up to 3 BTC, currently worth about $190,000, for information that leads to the recovery of bitcoin taken from merchants in last week’s exploit.
The Bitcoin payment platform said Tuesday it will pay 10% of any recovered amount, with the reward capped at 3 BTC. The program is open to anyone who can provide information that helps trace or recover the stolen funds, including the attacker.
People with relevant leads can contact BTCPay through its security channel, while secure communication methods are available for those who need them.
If multiple sources provide information that contributes to a successful recovery, BTCPay said the reward will be divided among the victims. The allocation will take into account each victim’s losses and the usefulness of the information supplied.
The project is also rewarding the researchers who uncovered and responsibly reported the vulnerability. BTCPay plans to donate 0.21 BTC each to developer Craig Raw and the Bitcoin Red Team.
The security flaw was exploited last week, giving attackers access to credentials used by LND, a popular implementation for running Lightning Network nodes. The attackers subsequently used those credentials to drain bitcoin from merchant wallets connected to affected nodes.
Foundation, a hardware-wallet company, and Bitcoin publication Citadel21 have both acknowledged losing funds during the incident. BTCPay and the affected parties have not provided a final figure for the total amount stolen.
BTCPay said several outside groups are assisting with the investigation, including crypto exchanges, blockchain analytics companies and law enforcement. Merchants affected by the attack have been encouraged to report the theft to local police and notify any platforms where the stolen bitcoin may surface.
The Bitcoin Red Team, a volunteer security group, has been using AI models to analyze Bitcoin codebases and has uncovered thousands of issues across hundreds of projects. Its researchers were among those who identified the vulnerability that led to the latest patch.
BTCPay has also urged merchants to strengthen their wallet security by storing most funds in cold wallets and regularly moving excess balances away from hot wallets. The company emphasized that these precautions are increasingly important as AI-assisted development continues to reshape the security landscape.
