BTCPay offers $190,000 bounty after bitcoin payment servers drained in exploit
Reported by CoinDesk · AI-assisted summary by ChikoCorp AI News Desk
AI-generated summary based on the linked source; not independently verified. This is not investment advice. Verify market-moving details at the original publisher before acting. See our editorial policy, AI content policy, and financial disclaimer.
Summary
BTCPay Server announced a bounty offering 10% of any recovered stolen bitcoin, up to 3 BTC (approximately $190,000), after a vulnerability allowed attackers to drain bitcoin wallets connected to their LND Lightning node software. Merchants affected include hardware-wallet maker Foundation and the bitcoin publication Citadel21. The flaw was discovered by the volunteer Bitcoin Red Team, which uses AI tools to scan bitcoin projects for bugs, and BTCPay has compensated the researchers with BTC donations.
Why it matters
The exploit targeted LND, the most commonly used Lightning node software, exposing a critical vulnerability that affected multiple merchants and caused financial losses. BTCPay’s bounty and collaboration with exchanges, analytics firms, and law enforcement highlight industry efforts to trace stolen funds and enhance security measures during a period of rapid AI-driven changes.
Key context
The Bitcoin Red Team began focusing AI models on bitcoin codebases in August 2026, filing thousands of findings across many projects, including the vulnerability exploited here. BTCPay has urged merchants to report thefts to police and services to which stolen funds are traced. They also advise keeping funds in cold storage and limiting holdings in hot wallets. The bounty will be split proportionally if multiple reports lead to recoveries.
Key numbers and entities
BTCPay Server offers a bounty of up to 3 BTC (~$190,000). They donated 0.21 BTC each to developer Craig Raw and the Bitcoin Red Team for the vulnerability disclosure. Affected merchants named include Foundation and Citadel21.
What remains unclear
BTCPay and the victims have not released a total amount stolen. The extent of the recovery effort progress and whether any stolen funds have been returned have not been reported. The source does not flag other open questions.