Supporters of BTCPay Server have committed to funding a bounty of up to three Bitcoins for the recovery of funds stolen through a recently disclosed vulnerability in the open-source bitcoin payment processor, the project said in a statement.
The bounty is set at 10 percent of whatever is recovered, capped at three coins in the event of a full recovery.
The project even extended the offer to the attacker directly alongside anyone else holding actionable information, directing them to a dedicated security address and offering Signal or other encrypted channels on request.
Hackers last week managed to extract Lightning Network admin macaroon credentials from affected BTCPay Server instances. The project published technical details and remediation guidance in a separate security advisory.
“To the users who lost funds: we are sorry,” the project said in a statement. “We will examine our mistakes, but regret alone will not help affected users or secure the project. There is no time to waste. We have to learn, improve, and act quickly.”
The BTCPay Server Foundation said it would donate 0.21 Bitcoins to Sparrow Wallet developer Craig Raw and a further 0.21 Bitcoins to the Bitcoin Red Team fund in recognition of their responsible disclosure of the vulnerability.
Separately, the project said it has been contacted by security teams at exchanges, blockchain analytics firms and law enforcement agencies offering assistance in tracking the stolen coins.
Affected users who have not yet come forward are being asked to share on-chain addresses and transaction details, and to file reports with local authorities and any exchange or service where the funds surface.
Individual reports, the project said, help preserve records and establish a chain of evidence that improves the odds of funds being frozen.
The project added that improving AI models are making it faster and cheaper to comb large codebases for weaknesses, shifting the balance toward attackers, and that Bitcoin projects are feeling it first because they are unusually valuable targets.