BTCPay Server Offers Up to 3 BTC Bounty to Recover Bitcoin Stolen in LND Attack

Node operator BTCPay Server announced on Tuesday that they have offered a bounty for the recovery of Bitcoin that was stolen last week, offering 10 percent of what is recovered as a reward, up to 3 BTC worth $190,000 (roughly Rs. 1.8 crore). The offer is open to anyone with useful information, even the attackers. The project invited everyone to contact them using their secure address and stated that they would provide secure channels for those who have information to share. 

Project Rewards Security Researchers After LND Credential Theft

The project will also reward the researchers who found the flaw with donations of 0.21 BTC each for Craig Raw and Bitcoin Red Team. The attackers were able to exploit this vulnerability last week to get the credentials to access the LND software, which is the most popular software used to operate a Lightning node and drain the wallets of LND users. This has led to the Foundation and Citadel21, a Bitcoin website, losing money. Neither BTCPay nor the victims have published a total so far. 

In a separate post, BTCPay stated that exchanges, blockchain analytics companies, and law enforcement have been assisting with tracking down the funds and encouraged victims to notify the local police and whichever organisation the funds end up being tracked to. The Bitcoin Red Team refers to the voluntary group that started testing Bitcoin codebases using AI this month, filing thousands of issues on a wide range of projects, including this patch based on a report from this group.

Meanwhile, BTCPay advised merchants to keep funds in cold storage and move excess out of hot wallets regularly, "especially during this period of rapid, AI-driven change." The exchange further added, “AI is changing the balance between attackers and defenders. As models improve, it becomes faster and cheaper to inspect large codebases and find weaknesses.”

Last week, the BTCPay Server blocked remote access to nodes on the Lightning Network that use Lightning Network Daemon (LND) software due to a vulnerability being exploited by hackers to steal credentials and transfer funds. BTCPay said that this ban will prevent external wallets like Zeus from accessing the node via the BTCPay Server domain Tor onion URL on Docker deployments.