BTCpay Servers Hit by Exploit, Offers Bounty for Recovered Funds
BTCPay Server has offered a bitcoin bounty to anyone who can help recover stolen funds after a recent exploit. The attackers stole Bitcoin by using credentials taken from vulnerable LND servers, and BTCPay is urging users running affected software to update to version 2.4.2 immediately.
The company said it will offer 10% of any recovered funds, capped at 3 BTC currently worth around $190,000. If multiple tips help recover the funds, the bounty will be divided in coordination with victims, taking into account each victim's losses and the usefulness of each tip.
BTCPay is also donating 0.21 BTC to security researcher Craig Raw and the Bitcoin Red Team fund for responsibly disclosing the vulnerability. The company said it is strengthening code reviews and prioritizing security patches over new features due to the increasing ease with which attackers can find vulnerabilities in Bitcoin software.