BTCPay Server supporters are offering a reward of 10% of the total recovered funds following the latest exploit, with a cap of up to 3 BTC, equivalent to $190,000. This offer is open to anyone who can help track and return the victims’ assets to their origin - and it does not close the door for the hacker to claim this bounty.
This offer follows a warning issued by BTCPay on Friday last week. When the incident was first detected, the development team asked node operators to take quick action: install the version 2.4.2 update or shut down their servers entirely. This option was taken because the exploit targeted core control. The attacker was found to have stolen LND admin macaroons - credentials that grant full and broad access to the victims’ Lightning Network nodes.
Reward Distribution System
If tips come from multiple parties, BTCPay has established clear rules for distributing the bounty. The total 3 BTC prize will be distributed based on two main factors: the percentage of each victim’s losses, and the level of contribution from each incoming tip that leads to the recovery of funds.
However, the full extent of the losses from this incident remains unclear. To date, BTCPay has not released an exact figure regarding the total amount of Bitcoin stolen by the hacker. They also did not specify how many users had their nodes affected by this exploit. The full scale of the breach has not yet been disclosed to the public.
New Threats from Artificial Intelligence
BTCPay Server Foundation’s response to this crisis also targets long-term prevention. They decided to donate 0.21 BTC each to independent security researcher Craig Raw and the Bitcoin Red Team fund initiative, two entities that continuously test the resilience of crypto infrastructure.
The support for these security researchers is backed by strong reasons. BTCPay noted that the landscape of Bitcoin software exploits has changed, with modern artificial intelligence (AI) tools making it easier for attackers to find code vulnerabilities. This situation forces more stringent code review standards, considering that hackers are now armed with AI to scan for weak spots in seconds.
The Last Resort
For node operators who have already lost assets due to this LND credential theft, options are limited. They now either rely on trackers racing to solve the puzzle for 3 BTC, or wait for the attacker to think logically: pocketing $190,000 in clean cash from the development team is always safer than running with stolen funds for life.
Reported from Decrypt.
Read also: What Is Bitcoin Halving?
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
