BTCPay Server Backs 10% Recovery Bounty After $3M Lightning Wallet Exploit

BTCPay Server users have backed a 10% recovery bounty to help recover stolen Bitcoin after a recent Lightning wallet exploit. The reward is capped at 3 BTC if all stolen assets are recovered.

The vulnerability exposed LND admin macaroon credentials, allowing attackers to access connected Lightning wallets. BTCPay fixed the issue in version 2.4.2, but its onchain wallets were not affected.

The project's supporters have also donated 0.21 BTC each to Craig Raw and the Bitcoin Red Team fund for discovering and reporting the flaw. BTCPay said AI may have helped uncover the vulnerability and is preparing a detailed postmortem.