BTCPay Server offers bounty up to 3 BTC after critical exploit drains payment servers

BTCPay Server supporters have launched a recovery bounty of up to 3 BTC (around $190,000) after a critical vulnerability allowed attackers to steal LND credentials and drain merchant Lightning nodes, including those of Foundation and Citadel21. The flaw was responsibly disclosed by Craig Raw and the Bitcoin Red Team, who received 0.42 BTC in total rewards. While the exploit highlights how AI is accelerating code vulnerability discovery, the core Bitcoin network remains unaffected, with prices holding steady near $64,000.

BTCPay Server LND macaroon vulnerability

• ▪BTCPay Server advised affected operators to update to BTCPay Server v2.4.2 and LND v0.21.1 immediately, rotate credentials, and replace the macaroon database to invalidate compromised keys
• ▪The exposed .macaroon credential files allowed remote attackers to obtain administrator access keys and take full control of connected LND Lightning nodes and wallets
• ▪BTCPay Server versions prior to 2.4.2, including 2.4.2 release candidates, contained a critical vulnerability that exposed LND Lightning node .macaroon credential files to unauthenticated remote access
• ▪BTCPay Server patched the LND credential vulnerability in version 2.4.2, which was officially released on August 7, 2026

Lightning node fund drainage attacks

• ▪Neither BTCPay Server nor the affected victims have publicly disclosed the total amount of bitcoin stolen or the exact number of nodes compromised in the exploit
• ▪Attackers actively exploited the BTCPay Server vulnerability to drain funds from connected Lightning nodes, including those operated by hardware-wallet maker Foundation and publication Citadel21
• ▪BTCPay Server on-chain wallets, including hot wallets, were not affected by the LND credential vulnerability, which was isolated to the Lightning integration layer

Recovery bounty program

• ▪The BTCPay Server recovery bounty is open to anyone providing information leading to the return of the funds, including the attacker, and will be split among victims if multiple reports lead to recovery
• ▪Supporters of BTCPay Server committed to funding a recovery bounty on August 10, 2026, offering 10% of any recovered stolen bitcoin up to a maximum cap of 3 BTC
• ▪BTCPay Server enlisted exchanges, blockchain analytics firms, and law enforcement to trace the stolen funds and urged affected merchants to report thefts to local police

Security researcher rewards

• ▪Craig Raw, the developer of Sparrow Wallet, and Bitcoin Red Team members Rob Hamilton, Calle, and Evan Kaloudis identified and privately disclosed the BTCPay Server vulnerability
• ▪The BTCPay Server Foundation donated 0.21 BTC each to security researcher Craig Raw and the Bitcoin Red Team fund for discovering and privately reporting the vulnerability

AI-assisted vulnerability discovery

• ▪The volunteer Bitcoin Red Team used AI models to scan bitcoin codebases, filing thousands of findings across hundreds of projects, including the report that led to the BTCPay Server patch
• ▪A prior exploit affecting Coldcard hardware wallets, which resulted in at least $116 million in confirmed losses, was likely uncovered by attackers using AI to review older public firmware versions
• ▪BTCPay Server suggested that artificial intelligence is changing the security balance by making it faster and cheaper for both defenders and attackers to inspect large codebases for weaknesses

Bitcoin price stability

• ▪Bitcoin prices remained stable near $64,000 on August 10, 2026, as market participants viewed the BTCPay Server exploit as an application-layer threat to merchants rather than a risk to the core Bitcoin network
• ▪The market value of Bitcoin was estimated at $1.28 trillion on August 10, 2026, experiencing a minor drop of approximately half a percent during the trading session