BTCPay Offers $190,000 Bounty After Bitcoin Steal
BTCPay Server has been hit by a security exploit that allowed attackers to steal Bitcoin using credentials taken from vulnerable LND servers. The company is offering a bounty of up to 3 BTC, currently worth around $190,000, for any information that could lead to the recovery of the stolen funds.
BTCPay warned users about the attacks on Friday and urged them to install a new version, 2.4.2, or take their servers offline. The flaw allowed attackers to obtain LND admin macaroons, which grant broad control over a Lightning Network node, and use them to access connected wallets.
The company is taking steps to strengthen code reviews and prioritize security patches over new features, citing the ease with which AI can find vulnerabilities in Bitcoin software. BTCPay has not disclosed how much Bitcoin was stolen or how many users were affected.