BTCPay Server announced Tuesday a bounty program offering 10% of any recovered stolen bitcoin, capped at 3 BTC—approximately $190,000 at current prices—following a security breach that drained funds from merchant Lightning wallets last week. According to a report by CoinDesk, the project is seeking information from anyone, including the attacker, and has enlisted exchanges, blockchain analytics firms, and law enforcement to trace the stolen funds.
What Happened in the BTCPay Exploit
The vulnerability stemmed from a flaw that allowed attackers to obtain LND (Lightning Network Daemon) credentials and drain connected wallets. Merchants, including prominent entities such as Foundation and Citadel21, were affected. The incident underscores the persistent security risks in Bitcoin infrastructure, echoing previous threats like the Lawsuit Alleges Apple Kept Fake Bitcoin Wallet on App Store After $875,000 Theft Report, where compromised wallet software led to significant losses. The BTCPay vulnerability was identified by researchers associated with the volunteer Bitcoin Red Team, which utilizes AI tools to scan bitcoin projects for bugs, and the project is compensating them with BTC donations.
Bounty and Security Implications
This is not the first time BTCPay Server has faced a security breach; earlier this year, an Another Bitcoin Infra Exploit Hits BTCPay Server, Draining Merchant Lightning Nodes similarly targeted Lightning node operators. The recurrence highlights the challenge of securing Lightning Network infrastructure. BTCPay is now urging merchants to keep the majority of their holdings in cold storage, a lesson underscored by research such as the Bitcoin Cold Wallets Drain $70M in Attack That Never Touched Hardware, Galaxy Research Reveals, which detailed how attackers can drain cold wallets without ever touching the hardware device. The bounty offer, coupled with law enforcement involvement, signals a more aggressive approach to recovering funds and deterring future exploits. As the investigation proceeds, the Bitcoin community watches to see whether the funds can be traced and recovered.
