BTCPay Bitcoin bounty offers up to 3 BTC after Lightning wallet exploit
BTCPay supporters pledged 10% of recovered funds, up to 3 BTC, after attackers drained some merchant Lightning wallets.
By Theo Nakamura · Staff Writer
· 2 min read
Supporters of BTCPay Server have put forward a BTCPay Bitcoin bounty after an exploit drained funds from some merchant Lightning wallets. The offer is designed to encourage information and the return of stolen bitcoin, rather than to automatically reimburse victims.
BTCPay said the reward equals 10% of funds recovered, with a ceiling of 3 BTC. CoinDesk estimated that maximum at roughly $190,000 at the time of its August 11 report. The project said people with useful information, including the attacker, may seek the reward through its security contact channel.
For merchants and investors following the incident, the key distinction is scope: reports describe a compromise of certain BTCPay Server installations using LND, software used to run a Lightning Network node. The reports do not describe an exploit of Bitcoin's base protocol.
How does the BTCPay Bitcoin bounty work?
The reward rises alongside the amount returned: 10% of recovered funds is paid until the reward reaches the 3 BTC limit. That cap would be reached if 30 BTC were recovered. If more than one tip helps recover funds, CoinDesk reported, BTCPay plans to divide the bounty with victims according to losses and the usefulness of the information.
No aggregate loss amount has been published by BTCPay or the affected merchants, according to CoinDesk. Hardware-wallet maker Foundation and bitcoin publication Citadel21 each reported losses, but the available reports do not establish how much was taken overall or whether any funds have been recovered.
What was affected by the exploit?
Attackers obtained LND credentials from vulnerable BTCPay Server setups and used them to drain connected Lightning wallets, according to CoinDesk and Cryptopolitan. Lightning is a payment network built on top of Bitcoin that enables faster transfers through payment channels; running a Lightning node means operating software and safeguarding its access credentials.
Cryptopolitan reported that the issue affected BTCPay Server versions before 2.4.2. It said BTCPay urged operators to update to version 2.4.2 or stop their servers while addressing the issue. BTCPay's on-chain wallets, including hot wallets, were not affected, according to Cryptopolitan and Binance News.
BTCPay also said exchanges, blockchain analytics firms and law enforcement had offered help tracing the stolen funds, CoinDesk reported. The project advised merchants to keep most holdings in cold storage, meaning wallets kept offline, and move excess balances out of internet-connected hot wallets regularly.
Separately from the recovery offer, BTCPay said it would donate 0.21 BTC to developer Craig Raw and another 0.21 BTC to the Bitcoin Red Team fund for responsible disclosure of the vulnerability, according to CoinDesk. Those payments reward the discovery and reporting of the flaw; they are distinct from the bounty tied to any recovered funds.
This story draws on original reporting from Decrypt.
