BTCPay Server Launches $190,000 Bounty Following Lightning Wallet Security Exploit

BTCPay Server, one of the most widely used open-source Bitcoin payment processors, has launched a $190,000 bounty program following a security exploit last week that drained merchant Lightning wallets.

LND Credential Compromise Shakes Merchant Infrastructure

Attackers successfully compromised Lightning Network Daemon (LND) credentials, gaining unauthorized access to connected merchant wallets and draining their funds. In response, BTCPay Server announced it will award 10% of the recovered assets, capped at 3 BTC (approximately $190,000), to anyone who can facilitate the return of the stolen capital.

Protocol Vulnerabilities and Immediate Remediation Steps

This exploit highlights the inherent risks of managing hot wallets within Layer-2 scaling solutions. The project has initiated several critical responses:

■Immediate suspension and revocation of compromised LND API credentials and macaroon authentication tokens.

■Urgent advisories issued to affected merchants to rotate their cryptographic keys and reset node access.

■Deployment of an emergency security patch across the BTCPay Server ecosystem to mitigate further exposure.

As Cem Talu, I view this exploit not merely as an isolated security breach, but as a critical teething pain for the institutional adoption of Bitcoin’s micro-payment infrastructure. While our on-chain UTXO analysis and ETF flow tracking indicate that institutional capital remains insulated from Layer-2 vulnerabilities, retail and merchant-level trust is temporarily bruised. Transitioning from simple hot-wallet setups to robust multi-signature custody frameworks is no longer optional for businesses operating on the Lightning Network.