BTCPay Server supporters back 10% bounty to recover stolen Bitcoin

BTCPay Server supporters have backed a recovery bounty equal to 10% of funds retrieved from a recent Lightning wallet exploit, with the reward capped at 3 BTC if all stolen assets are recovered. Summary BTCPay Server supporters have backed a 10% recovery bounty, capped at 3 BTC if all stolen funds are recovered. The exploit exposed LND admin macaroon credentials, allowing attackers to access connected Lightning wallets. BTCPay fixed the vulnerability in version 2.4.2, while its onchain wallets were not affected. The BTCPay Server Foundation is donating 0.21 BTC each to Craig Raw and the Bitcoin Red Team fund for discovering and reporting the flaw. BTCPay said AI may have helped uncover the vulnerability and is preparing a detailed postmortem. The BTCPay Server project said on Monday that the bounty is part of its response to a critical security flaw that exposed LND administrator credentials on vulnerable installations, days after users were told to immediately upgrade to version 2.4.2. The open-source Bitcoin payment processor has not disclosed how much cryptocurrency was stolen or how many servers were compromised. However, several affected users, including Foundation and Citadel...