Key facts
- BTCPay Server is offering a bounty of up to 3 BTC for the recovery of stolen funds.
- The bounty represents 10% of any recovered amount.
- The theft occurred due to a vulnerability in LND Lightning node software.
- Affected merchants include Foundation and Citadel21.
- BTCPay Server is prioritizing security patches over new feature development.
BTCPay Server, an open-source Bitcoin payment processor, has announced a bounty of up to 3 BTC for the recovery of funds stolen from merchants last week. The bounty is set at 10% of any recovered amount, with a maximum payout of 3 BTC, valued at approximately $190,000. The theft resulted from a vulnerability in the LND Lightning node software, which allowed attackers to obtain credentials and drain connected wallets. Hardware-wallet maker Foundation and the publication Citadel21 were among the affected entities. BTCPay Server is collaborating with exchanges, blockchain analytics firms, and law enforcement to trace the funds. The project is also donating 0.21 BTC each to developer Craig Raw and the Bitcoin Red Team for their responsible disclosure of the vulnerability. In response to the incident, BTCPay Server stated it will indefinitely prioritize security patches over new feature development and advised merchants to keep excess funds in cold storage.