BTCPay Server has launched a bounty worth up to 3 BTC, or roughly $190,000, for information that helps retrieve bitcoin stolen from merchants during a security exploit last week.
The Bitcoin payment service said Tuesday that it will pay 10% of any recovered funds, subject to a maximum reward of 3 BTC. The offer is available to anyone who can provide useful information, including the person or group responsible for the theft.
Those with relevant leads have been asked to contact BTCPay through its security channel. The project said it can provide secure communication options for sources who require them.
If information from multiple sources contributes to recovering the stolen bitcoin, the bounty will be distributed among victims based on their respective losses and the usefulness of each contribution.
BTCPay is also recognizing the researchers who discovered the vulnerability. The project said it will contribute 0.21 BTC to developer Craig Raw and another 0.21 BTC to the Bitcoin Red Team for their responsible disclosure of the security issue.
The exploit enabled attackers to obtain credentials associated with LND, a widely used software implementation for operating Lightning Network nodes. Once the credentials were compromised, the attackers were able to access and drain bitcoin held in connected merchant Lightning wallets.
Foundation, a hardware-wallet manufacturer, and Bitcoin publication Citadel21 have both confirmed losses from the incident. Neither BTCPay nor the affected businesses has released a complete estimate of the stolen funds.
BTCPay said cryptocurrency exchanges, blockchain analytics firms and law enforcement agencies are helping investigate the transactions and trace the stolen assets. The company encouraged affected merchants to report the theft to local police and alert any services where the funds may be transferred.
The Bitcoin Red Team is a volunteer security group that has recently been using AI systems to examine Bitcoin-related code. The team has reported thousands of potential issues across hundreds of projects, including the vulnerability behind the latest BTCPay patch.
BTCPay has advised merchants to keep the majority of their holdings in cold wallets and routinely move excess funds out of hot wallets. The project said maintaining these safeguards is particularly important as AI-driven development and security research accelerate.
