BTCPay bounty: $190k for stolen bitcoin Lightning funds
BTCPay Server announced a BTCPay bounty after merchants’ Bitcoin payment servers were drained in an exploit linked to Lightning node credentials. The project will pay 10% of any recovered stolen bitcoin, capped at 3 BTC (about $190,000), to anyone providing information leading to the funds’ return, including the attacker.
According to BTCPay, attackers last week exploited a vulnerability to obtain LND (Lightning Network Daemon) credentials and drain connected Lightning wallets. Affected merchants included Foundation and the bitcoin publication Citadel21, but the total stolen amount has not been published by BTCPay or the victims.
BTCPay said it has engaged exchanges, blockchain analytics firms and law enforcement to trace the money. It also urged merchants to file reports with local police and with any service where traced funds may land. For operational risk control, BTCPay advised moving excess from hot wallets to cold storage and doing so more frequently during this period of “rapid, AI-driven change.”
Separately, BTCPay is paying researchers tied to the “Bitcoin Red Team” and developer Craig Raw for responsible disclosure, donating 0.21 BTC to each. The vulnerability’s report was used to create the patch that addresses the issue.
BTCPay bounty details may influence sentiment among traders who track exchange/merchant security events and potential sell-pressure tied to stolen BTC recovery timelines.
Neutral
This is primarily a security and remediation story rather than a macro or protocol-change catalyst. The BTCPay bounty is designed to increase the odds of recovering stolen BTC, which can reduce longer-term sell-pressure if funds are returned. However, until the amount is quantified and recovery is confirmed, traders should treat it as uncertain: stolen BTC can still be sold or laundered during the investigation window.
Historically, large crypto security incidents often create short-term volatility driven by fear of liquidation, counterparty risk, and “how much was stolen” headlines. But when a bounty and tracing cooperation lead to recoveries, sentiment can stabilize and volatility can fade. In the short term, the news is more likely to affect sentiment around Lightning/LND custody hygiene and hot-vs-cold wallet practices than to move broader BTC market structure.
In the long run, the emphasis on responsible disclosure and faster patching (plus AI-assisted code scanning referenced by the Red Team) may marginally improve ecosystem security expectations, but it’s unlikely to be strong enough to drive sustained market trends without confirmation of recovery totals.