BTCPay offers $190,000 bounty after bitcoin payment servers drained in exploit
The project said it will pay 10% of recovered funds, up to 3 BTC, after attackers stole LND credentials and drained merchant Lightning wallets last week.
Make preferred on
Share this article
Summary
- BTCPay Server is offering a bounty of 10% of any recovered stolen bitcoin, up to 3 BTC, to anyone with information leading to the funds’ return, including the attacker.
- The theft stemmed from a vulnerability that let attackers obtain LND Lightning node credentials and drain connected wallets, affecting merchants including Foundation and Citadel21.
- BTCPay has enlisted exchanges, blockchain analytics firms and law enforcement to help trace the funds, while urging merchants to report losses and keep most holdings in cold storage.
- The flaw was identified by researchers tied to the volunteer Bitcoin Red Team, which is using AI tools to scan bitcoin projects for bugs, and BTCPay is compensating them with BTC donations.
The project is also paying the researchers who found the flaw, donating 0.21 BTC each to developer Craig Raw and to the Bitcoin Red Team fund.
Attackers exploited the vulnerability last week to obtain credentials for LND, the most widely used software for running a Lightning node, and to drain the wallets associated with it.
Hardware-wallet maker Foundation and the bitcoin publication Citadel21 both reported losing funds. Neither BTCPay nor the victims have published a total so far.
