Digital Wallet

Story: BTCPay Server Posts $190,000 Bounty After Lightning Node Exploit Drains Merchant Wallets

By Steven Anderson

1 / 15

How the Exploit Actually Worked. The attackers got in by exploiting a vulnerability that let them grab credentials for LND —…

2 / 15

Bitcoin Red Team's Role and the AI Security Push. The Bitcoin Red Team is a volunteer group. No corporate backing, no big budget.

3 / 15

What Merchants Should Do Right Now. BTCPay Server's guidance is direct: report the theft to local authorities if you were affected.

4 / 15

BTCPay Server is dangling up to $190,000 for anyone who can help recover bitcoin stolen in a recent exploit. Anyone. Including, apparently, whoever took it.

5 / 15

The open-source payment processor confirmed the breach and said it's offering a bounty equal to 10% of whatever funds get recovered, capped at 3 BTC — worth roughly $190,000 at…

6 / 15

The attackers got in by exploiting a vulnerability that let them grab credentials for LND — Lightning Network Daemon, the widely-used software that merchants run to operate a…

7 / 15

Among the confirmed victims: Foundation, the hardware wallet manufacturer, and Citadel21, a bitcoin-focused publication. Neither has said publicly how much they lost.

8 / 15

BTCPay Server said exchanges, blockchain analytics firms, and law enforcement are all now involved in tracing the stolen bitcoin.

9 / 15

Two researchers got rewarded for doing the right thing. Developer Craig Raw and the Bitcoin Red Team each received a donation of 0.

10 / 15

See also: H100 Grabs 2,455 Bitcoin and Becomes Europes Second-Largest Corporate Treasury

11 / 15

The Bitcoin Red Team is a volunteer group. No corporate backing, no big budget. Their focus is pointing AI models at bitcoin codebases to find weaknesses before bad actors do.

12 / 15

It's worth sitting with that for a second. A volunteer group using AI-assisted code review caught a vulnerability that, once exploited, led to a six-figure theft affecting named…

13 / 15

BTCPay Server, for its part, is now pushing merchants hard on cold storage. The advice isn't new, but the breach makes it feel more urgent: keep funds in cold storage, move…

14 / 15

Hot wallets are convenient. They're also, pretty much by definition, exposed. The LND exploit is a reminder that convenience in bitcoin infrastructure carries real financial risk…

15 / 15

See also: Ethereum Holders Tap ASDeFi for $7,000 Monthly Earnings

The Currency Analytics

Want the full story?