BTCPay Server offered a recovery bounty equal to 10% of recovered funds capped at three BTC after a disclosed vulnerability allowed attackers to extract Lightning Network admin macaroon credentials; the Foundation also donated 0.21 BTC each to Sparrow Wallet developer Craig Raw and the Bitcoin Red Team for responsible disclosure. Exchanges, blockchain analytics firms and law enforcement are assisting and BTCPay is asking affected users to submit on-chain addresses and reports to CEXs to improve chances of freezing funds, while warning that advances in AI are accelerating automated codebase scanning and increasing security risks for crypto projects and DeFi infrastructure.

Bearish

Predictions Markets

See what traders are focused on

View analytics →

Bitcoin Magazine

BTCPay Server Offers 3 Bitcoin Bounty for Recovery of Stolen Funds After Wallet Exploit

Supporters of BTCPay Server have committed to funding a bounty of up to three Bitcoins for the recovery of funds stolen through a recently disclosed vulnerability in the open-source bitcoin payment processor, the project said in a statement.

The bounty is set at 10 percent of whatever is recovered, capped at three coins in the event of a full recovery.

The project even extended the offer to the attacker directly alongside anyone else holding actionable information, directing them to a dedicated security address and offering Signal or other encrypted channels on request.

Hackers last week managed to extract Lightning Network admin macaroon credentials from affected BTCPay Server instances. The project published technical details and remediation guidance in a separate security advisory.

“To the users who lost funds: we are sorry,” the project said in a statement. “We will examine our mistakes, but regret alone will not help affected users or secure the project. There is no time to waste. We have to learn, improve, and act quickly.”

The BTCPay Server Foundation said it would donate 0.21 Bitcoins to Sparrow Wallet developer Craig Raw and a further 0.21 Bitcoins to the Bitcoin Red Team fund in recognition of their responsible disclosure of the vulnerability.

Separately, the project said it has been contacted by security teams at exchanges, blockchain analytics firms and law enforcement agencies offering assistance in tracking the stolen coins.

Affected users who have not yet come forward are being asked to share on-chain addresses and transaction details, and to file reports with local authorities and any exchange or service where the funds surface.

Individual reports, the project said, help preserve records and establish a chain of evidence that improves the odds of funds being frozen.

The project added that improving AI models are making it faster and cheaper to comb large codebases for weaknesses, shifting the balance toward attackers, and that Bitcoin projects are feeling it first because they are unusually valuable targets.

This post BTCPay Server Offers 3 Bitcoin Bounty for Recovery of Stolen Funds After Wallet Exploit first appeared on Bitcoin Magazine and is written by Mathew Di Salvo.

Read the article at Bitcoin Magazine