BTCPay Server said it will pay 10% of recovered funds, up to 3 BTC, after attackers stole LND credentials and drained merchant Lightning wallets last week.

BTCPay Server — an open-source, self-hosted Bitcoin payment processor used by merchants worldwide to accept BTC without relying on third-party payment providers — announced Tuesday that it is funding a bounty for the return of bitcoin stolen from merchants last week, offering 10% of whatever is recovered up to a maximum of 3 BTC — worth roughly $190,000 at current prices. The offer is open to anyone with useful information, including the attacker themselves. The project asked individuals to write to its security address and noted that secure communication channels are available on request.

If multiple reports contribute to a recovery, the bounty will be split between the tipsters and the victims in proportion to how much each party lost and how valuable each piece of information proves to be.

The theft stemmed from a vulnerability that allowed attackers to obtain credentials for LND — the most widely used software for running a Lightning Network node — and drain the wallets connected to it. The Lightning Network is Bitcoin's primary layer-2 scaling solution, enabling near-instant, low-cost transactions through off-chain payment channels that merchants rely on for everyday commerce. Hardware-wallet manufacturer Foundation and Bitcoin publication Citadel21 both publicly reported losing funds. Neither BTCPay nor the affected victims have disclosed a total loss figure at this time.

The vulnerability was identified by researchers associated with the volunteer Bitcoin Red Team, which began directing AI models at Bitcoin codebases this month. The group has filed thousands of bug reports across hundreds of projects, including the finding that led to the patch for this flaw. The episode marks one of the first documented cases in which AI-assisted code review surfaced a critical vulnerability exploited in the wild across Bitcoin payment infrastructure. BTCPay confirmed it is compensating the researchers who discovered the issue, donating 0.21 BTC each to developer Craig Raw and to the Bitcoin Red Team fund.

We're donating 0.21 BTC to @craigraw and 0.21 BTC to the Bitcoin Red Team for their responsible security disclosure of the recent critical vulnerability. In addition, friends and supporters of the BTCPay Server project have committed to funding a bounty to recover the stolen… pic.twitter.com/qhs8zwoCvM
— BTCPay Server (@BtcpayServer) August 10, 2026

In a separate post, BTCPay stated that exchanges, blockchain analytics firms, and law enforcement have all offered assistance in tracing the stolen funds. The project urged affected merchants to file reports with local police and with any service to which the funds are traced. BTCPay also advised merchants to store the majority of their holdings in cold storage and to regularly move excess funds out of hot wallets, "especially during this period of rapid, AI-driven change."

Source: CoinDesk