BTCPay Server Offers 3 BTC Bounty After LND Exploit Drains Merchant Funds

Woofun AI reports that BTCPay Server has authorized a bounty of up to 3 BTC, valued at approximately $190,000, to facilitate the return of bitcoin stolen from merchants last week. This financial incentive follows the identification of a critical vulnerability by Craig Raw and the Bitcoin Red Team, whose responsible disclosure prompted immediate remediation efforts.

The bounty structure allocates 10% of any recovered assets to informants, with the offer remaining open to any party possessing useful information, including the attacker. Per Woofun AI, the project designated a specific security address for submissions and confirmed that multiple successful reports will result in the bounty being split among victims based on loss magnitude and informational utility.

Additionally, the project has donated 0.21 BTC each to Craig Raw and the Bitcoin Red Team for their role in identifying the flaw.

The exploit targeted LND, the most widely used software for running a Lightning node, allowing attackers to obtain credentials and drain attached wallets. Hardware-wallet maker Foundation and the bitcoin publication Citadel21 both reported losing funds through this mechanism, though neither BTCPay nor the victims have published a total loss figure. The breach occurred last week, highlighting the risks associated with hot wallets and compromised node credentials.

Recovery efforts are now supported by exchanges, blockchain analytics firms, and law enforcement, who have offered assistance in tracing the stolen assets. BTCPay urges affected merchants to report the theft to local police and any service where funds are traced. The project advises keeping funds in cold storage and moving excess out of hot wallets regularly, "especially during this period of rapid, AI-driven change."