BTCPay Server Offers 3 Bitcoin Bounty for Recovery of Stolen Funds After Wallet Exploit

Supporters of BTCPay Server have committed to funding a bounty of up to three Bitcoins for the recovery of funds stolen through a recently disclosed vulnerability in the open-source bitcoin payment processor, the project said in a statement.

The bounty is set at 10 percent of whatever is recovered, capped at three coins in the event of a full recovery. 

The project even extended the offer to the attacker directly alongside anyone else holding actionable information, directing them to a dedicated security address and offering Signal or other encrypted channels on request. 

Hackers last week managed to extract Lightning Network admin macaroon credentials from affected BTCPay Server instances. The project published technical details and remediation guidance in a separate security advisory.

“To the users who lost funds: we are sorry,” the project said in a statement. “We will examine our mistakes, but regret alone will not help affected users or secure the project. There is no time to waste. We have to learn, improve, and act quickly.”

The BTCPay Server Foundation said it would donate 0.21 Bitcoins to Sparrow Wallet developer Craig Raw and a further 0.21 Bitcoins to the Bitcoin Red Team fund in recognition of their responsible disclosure of the vulnerability.