BTCPay Server Backs 10% Bounty to Recover Stolen Bitcoin

BTCPay Server, an open-source Bitcoin payment processor, has faced a critical security flaw that exposed LND administrator credentials on vulnerable installations. The exploit allowed attackers to access connected Lightning wallets and drained funds from affected users.

The vulnerability was fixed in version 2.4.2 of the software, but it's unclear how much cryptocurrency was stolen or which servers were compromised. BTCPay has introduced a 10% recovery bounty for successfully recovered funds, with a maximum reward of 3 BTC if all stolen assets are recovered.

The project has also donated 0.21 BTC each to Craig Raw and the Bitcoin Red Team fund for discovering and reporting the flaw. AI may have played a role in finding the vulnerable code, according to BTCPay, which is preparing a detailed postmortem on the incident.