BTCPay Server supporters have announced a recovery bounty worth up to 3 Bitcoin—approximately $190,000 at current prices—after attackers exploited a critical vulnerability and drained funds from multiple Lightning Network nodes.
The bounty will equal 10% of any stolen funds successfully recovered, with the maximum payment capped at 3 BTC if all affected funds are returned. The offer is open to anyone who can provide actionable information, including the attacker. BTCPay has invited potential informants to contact its security team through encrypted communication channels.
The project has not publicly disclosed the total amount stolen or the number of affected operators. However, several users, including hardware wallet manufacturer Foundation, Bitcoin publication Citadel21 and Sparrow Wallet developer Craig Raw, reported losses connected to the incident.
Attackers Obtained Powerful LND Credentials
The vulnerability affected BTCPay Server installations connected to LND, one of the most widely used implementations of the Bitcoin Lightning Network. According to BTCPay’s security disclosure, attackers were able to obtain LND administrator macaroon credentials from vulnerable servers.
Macaroons function as authorization credentials for Lightning nodes. An administrator-level macaroon can provide extensive control over a connected node and wallet, potentially allowing its holder to close payment channels and transfer funds.
All BTCPay Server versions released before version 2.4.2—including release candidates for 2.4.2—were vulnerable. Operators were instructed to install the patched version immediately or shut down their servers until the update could be completed.
The incident affected connected Lightning wallets rather than Bitcoin’s base-layer blockchain. BTCPay said its standard on-chain wallets and hot wallets were not exposed through this particular vulnerability. The distinction is important because the exploit targeted payment infrastructure built around Bitcoin, not the Bitcoin protocol itself.
Still, the attack adds to mounting concern over weaknesses in Bitcoin-related infrastructure. A volunteer security group recently identified 85 critical bugs across hundreds of Bitcoin projects, demonstrating how vulnerabilities in wallets, applications and supporting services can expose users even when the underlying network remains secure.
Recovery Bounty and Security Contributions
Supporters of the open-source payment processor will finance the recovery bounty. Participants who help retrieve stolen funds can receive 10% of the recovered amount, subject to the 3 BTC maximum. If information from multiple sources contributes to a recovery, the reward may be distributed among them.
Separately, the BTCPay Server Foundation said it would donate 0.21 BTC each to Craig Raw and the Bitcoin Red Team fund in recognition of their work discovering and privately reporting the vulnerability.
BTCPay is also preparing a more detailed postmortem. The project said it plans to strengthen its code-review and vulnerability-detection processes, while giving security fixes priority over new product features.
The response comes as other Bitcoin services confront similar operational risks. Bitcoin bridge provider Boltz was recently shut down amid a rise in AI-assisted cyberattacks, while a separate Coldcard wallet exploit raised fresh questions about Bitcoin security procedures.
Industry data has also shown that operational breaches are becoming a major source of cryptocurrency losses, often overtaking traditional smart-contract vulnerabilities as attackers increasingly target credentials, infrastructure and internal security controls.
What BTCPay Server Operators Should Do
Operators using BTCPay Server should confirm that they are running version 2.4.2 or later. Those who cannot update immediately should keep affected servers offline.
LND users should also ensure that exposed administrator macaroons have been invalidated or regenerated. Updating the application closes the original vulnerability, but rotating potentially compromised credentials is essential to prevent an attacker from continuing to access a Lightning node.
The exploit highlights a central trade-off in self-hosted payment infrastructure. BTCPay gives merchants direct control over their Bitcoin payments and removes dependence on centralized processors, but each operator is responsible for maintaining, updating and securing their own installation.
For merchants, the lesson is clear: security updates involving active exploitation should be treated as emergency actions, especially when payment nodes and administrative credentials are involved.
