BTCPay backers offer a recovery bounty after wallet thefts

The offer pays 10% of recovered bitcoin, capped at 3 BTC, after attackers used exposed LND admin credentials to reach connected wallets.

By The Third AnglePublished August 12, 2026 at 14:17 UTC3 min read

The Bitcoin symbol in orange and white. — Bitcoin symbol, used as an illustration for the funds targeted through BTCPay Server deployments. Photo: Wikimedia Commons · Public domain

BTCPay says the flaw allowed attackers to obtain LND admin macaroons, credentials that grant broad control over a Lightning node, and use them to access connected wallets. The project warned users Aug. 7 to install version 2.4.2 or take affected servers offline.

The affected amount is still undisclosed

BTCPay had not disclosed how much bitcoin was stolen, how many operators were affected or whether any funds had been recovered at publication time. If multiple tips contribute, the bounty will be divided based on victim losses, recovery amounts and the usefulness of the information.

Operators should treat the bounty as a recovery effort, not a substitute for remediation. Upgrading, rotating exposed credentials and checking Lightning and onchain wallet activity remain the immediate controls for any server that ran a vulnerable version.

From our reporting

Security · 3 min readColdcard adds firmware safeguards as reported wallet losses reach $130 million

Coinkite's recommended releases add user-supplied entropy and transaction checks, but they do not repair seeds created on affected firmware.

Build the background

Advanced · Security · 14 min readHow to respond to a wallet compromise

Follow a wallet incident triage process: identify exposed authority, protect clean assets, revoke permissions, preserve evidence, and rebuild from trusted devices.

Loading the next story…

Continue to the next story: Trump Media and Crypto.com end their CRO treasury venture before launch

Read the earlier context

Build the background