BTCPay Server has announced a reward of up to 3 BTC for information leading to the recovery of stolen funds from Lightning nodes.
BTCPay Server has announced a reward initiative aimed at recovering Bitcoin stolen from Lightning nodes due to a software vulnerability. As part of this initiative, the reward will be calculated at 10% of the recovered stolen amount, with a maximum payout of 3 BTC, or about $190,000, if the entire sum is returned.
This reward is backed by various unnamed sponsors and supporters of BTCPay Server, referred to as "friends and supporters" in the announcement. They have emphasized the importance of informing the team about any leads concerning the stolen coins, including information about the attackers themselves.
If the recovery involves multiple contributors, the reward will be distributed among them according to their contributions and the significance of the information provided. Meanwhile, the BTCPay Server Foundation will also award 0.21 BTC each to Craig Raw, a developer associated with Sparrow Wallet, and the Bitcoin Red Team for their responsible disclosure regarding the vulnerability.
The foundation noted that while the compensation amounts are relatively small, this is due to BTCPay's status as a non-profit Free and Open Source Software (FOSS) project.
"We are donating 0.21 BTC to @craigraw and 0.21 BTC to the Bitcoin Red Team for their responsible security disclosure of the recent critical vulnerability," BTCPay Server shared on Twitter.
Victims of the theft have been urged to report the incident to local authorities and any platforms where the stolen Bitcoin might have been transferred. Developers have indicated that assistance has been offered by various security services, blockchain analytics firms, and law enforcement agencies.
The specifics of the breach, including the total amount lost and the number of affected nodes, have not been fully disclosed, but a detailed analysis is anticipated in the future. It has been clarified that the attack was aimed at connections with LND and did not affect on-chain wallets. In response, BTCPay Server has temporarily disabled public access to the LND API on its Docker builds, restricting external wallets from connecting via BTCPay's domain.
The team is prioritizing security improvements by patching vulnerabilities and enhancing their code review processes with external auditors. They are also analyzing reports from the Bitcoin Red Team and other independent security researchers.
Users are advised to secure their funds using cold wallets, a precautionary measure that reflects the increasing threats posed by AI-driven vulnerability discovery. The team noted that the rapid advancements in AI technology are giving attackers a significant advantage, making Bitcoin projects, in particular, prime targets.
"Artificial intelligence is shifting the balance of power: attackers gain the upper hand. Models are becoming smarter, making it cheaper and faster to find holes in large codebases," said BTCPay in their announcement.
