BTCPay Server donates 0.42 BTC for responsible vulnerability disclosure and offers bounty for stolen fund recovery