BTCPay Server, an open-source bitcoin payments processor that recently disclosed a critical vulnerability, has committed to supporting a recovery bounty. The bounty is set at 10% of any funds recovered, with a cap of 3 BTC for full recovery.
The vulnerability allowed attackers to obtain LND admin macaroon credentials from affected instances and use them to access connected LND wallets. This exploit resulted in the theft of master access keys from certain Bitcoin payment servers, leading to significant financial losses.
BTCPay Server’s version 2.4.2 has now fixed this issue. The bounty is offered by BTCPay Server in collaboration with the Bitcoin Red Team and Foundation and Citadel21, two users who were affected by the vulnerability. This initiative aims to encourage recovery of funds lost through the exploitation of the critical vulnerability.
The exact amount of funds stolen or the number of nodes affected has not been publicly disclosed, leaving some uncertainty about the full extent of the loss. Users like Foundation and Citadel21 reported that their Lightning wallets were drained as a result of this exploit.
Written by Daniel Brooks
Security Desk
