BTCPay Offers $190K Reward to Find Attackers Behind Bitcoin Payment Exploit

BTCPay Server is offering a bounty of up to 3 BTC, worth about $190,000, for information that helps recover bitcoin stolen from merchants during last week’s security breach.

The Bitcoin payment platform said Tuesday that it will reward anyone who provides actionable information with 10% of the funds recovered, capped at 3 BTC. The offer also extends to the attacker.

BTCPay encouraged anyone with relevant information to contact its security team through its designated email address, adding that secure communication channels can be arranged when needed.

If multiple pieces of information contribute to recovering the stolen funds, the bounty will be divided among the affected victims based on the amount each person lost and the value of the information provided.

The project is also compensating the security researchers who discovered and responsibly disclosed the vulnerability. BTCPay said it will donate 0.21 BTC to developer Craig Raw and another 0.21 BTC to the Bitcoin Red Team.

The vulnerability was exploited last week, allowing attackers to obtain credentials linked to LND, the software most commonly used to operate Lightning Network nodes. The stolen access was then used to drain bitcoin from merchant wallets connected to those nodes.

Hardware-wallet company Foundation and Bitcoin-focused publication Citadel21 have both confirmed that they lost funds in the incident. BTCPay and the affected organizations have not yet disclosed the total amount stolen.

In a separate update, BTCPay said cryptocurrency exchanges, blockchain analytics companies and law enforcement agencies are assisting with efforts to track the stolen bitcoin. The company urged affected merchants to file reports with local authorities and notify any platforms where the stolen funds may eventually be deposited.

The Bitcoin Red Team, a volunteer security initiative, has been using AI models to examine Bitcoin-related codebases and has reported thousands of potential vulnerabilities across hundreds of projects. Its work included identifying the flaw that resulted in the recent security patch.

BTCPay has also advised merchants to keep most funds in cold storage and regularly transfer excess balances out of hot wallets. The project said this precaution is particularly important amid rapid changes driven by AI-assisted development and security research.