Key Takeaways
- • BTCPay Server Foundation is offering a recovery bounty of 10% of stolen funds, capped at 3 BTC (approximately $190,000), following a disclosed vulnerability that exposed Lightning Network admin macaroon credentials to attackers.
- • The project extended the bounty offer directly to the attacker alongside legitimate security researchers, establishing a dedicated security address and offering encrypted communication channels (Signal or equivalent) to facilitate fund recovery negotiations.
- • BTCPay Server Foundation donated 0.21 BTC each to Sparrow Wallet developer Craig Raw and the Bitcoin Red Team in recognition of responsible disclosure practices, demonstrating commitment to security researcher cooperation.
- • Affected users are being directed to submit on-chain addresses and incident reports to centralized exchanges to improve prospects of freezing stolen funds, with exchanges and blockchain analytics firms actively assisting in recovery efforts.
- • The project highlighted accelerating security risks across crypto infrastructure, noting that advances in AI-driven automated codebase scanning are escalating vulnerability discovery and exploitation rates for open-source projects and DeFi platforms.
Summary
BTCPay Server, a free and open-source cryptocurrency payment processor enabling direct Bitcoin and Lightning Network transactions without intermediaries or fees, disclosed a critical security vulnerability that allowed attackers to extract admin macaroon credentials from affected instances. In response, the project's supporters committed to funding a recovery bounty valued at 10% of any recovered stolen funds, with a maximum payout of 3 BTC (approximately $190,000 at current market rates).
The bounty structure represents an economic incentive for multiple parties to participate in fund recovery. BTCPay explicitly extended the offer to the attacker directly alongside legitimate security researchers and recovery specialists, signaling willingness to negotiate through a dedicated security address with support for encrypted communication channels. This approach acknowledges that attackers themselves may have operational or financial incentives to return funds if compensation offsets their acquisition costs or presents reputational advantages.
The BTCPay Server Foundation reinforced its commitment to security researcher collaboration by donating 0.21 BTC each to Sparrow Wallet developer Craig Raw and the Bitcoin Red Team, recognizing their roles in responsible disclosure. In its public statement, the project acknowledged responsibility for the incident while emphasizing immediate action: "To the users who lost funds: we are sorry. We will examine our mistakes, but regret alone will not help affected users or secure the project."
To maximize recovery chances, BTCPay is directing affected users to submit on-chain addresses and incident details to centralized exchanges for potential fund freezing. Exchanges, blockchain analytics firms, and law enforcement agencies are actively participating in the recovery effort. The project also issued a broader warning to the crypto development community, noting that artificial intelligence-driven automated codebase scanning is accelerating the discovery and exploitation of vulnerabilities across open-source projects and decentralized finance infrastructure, raising systemic security risks that extend beyond BTCPay itself.
The bounty structure represents an economic incentive for multiple parties to participate in fund recovery. BTCPay explicitly extended the offer to the attacker directly alongside legitimate security researchers and recovery specialists, signaling willingness to negotiate through a dedicated security address with support for encrypted communication channels. This approach acknowledges that attackers themselves may have operational or financial incentives to return funds if compensation offsets their acquisition costs or presents reputational advantages.
The BTCPay Server Foundation reinforced its commitment to security researcher collaboration by donating 0.21 BTC each to Sparrow Wallet developer Craig Raw and the Bitcoin Red Team, recognizing their roles in responsible disclosure. In its public statement, the project acknowledged responsibility for the incident while emphasizing immediate action: "To the users who lost funds: we are sorry. We will examine our mistakes, but regret alone will not help affected users or secure the project."
To maximize recovery chances, BTCPay is directing affected users to submit on-chain addresses and incident details to centralized exchanges for potential fund freezing. Exchanges, blockchain analytics firms, and law enforcement agencies are actively participating in the recovery effort. The project also issued a broader warning to the crypto development community, noting that artificial intelligence-driven automated codebase scanning is accelerating the discovery and exploitation of vulnerabilities across open-source projects and decentralized finance infrastructure, raising systemic security risks that extend beyond BTCPay itself.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.