BTCPay Offers Up to $190,000 Bounty to Recover Stolen Bitcoin

BTCPay, a Bitcoin payments server project, is offering a bounty to help recover Bitcoin stolen in a recent exploit of a security vulnerability.

CoinDesk reported on Aug. 11 that BTCPay Server will pay 10% of recovered losses as a bounty, capped at 3 BTC, or about $190,000. The offer is open to anyone who provides useful information, including the attacker. If multiple tips lead to a recovery, the bounty will be split according to the size of the losses and the usefulness of the information.

The incident began last week when attackers exploited a vulnerability in BTCPay Server, stole credentials for LND, software used to operate Lightning Network nodes, and drained connected wallets. Hardware wallet maker Foundation and Bitcoin-focused media outlet Citadel21 have disclosed losses, though the total amount stolen has not been made public.

BTCPay separately paid 0.21 BTC each to developer Craig Raw, who discovered and responsibly disclosed the vulnerability, and to the Bitcoin Red Team Fund. The Bitcoin Red Team is a volunteer group that began applying artificial intelligence models to the Bitcoin codebase this month and has uncovered thousands of vulnerabilities across hundreds of projects. The report that led to the patch in this case was also submitted by the group.

BTCPay said exchanges, blockchain analytics firms and law enforcement agencies are helping track the funds. It urged victims to report the theft to local police and to any service where the funds have been traced. It also recommended storing funds in cold storage and regularly moving balances out of hot wallets.