BTCPay backers offer bitcoin bounty after wallet exploit

Donors and supporters within the BTCPay community assembled a bitcoin bounty after users reported unauthorized access to a wallet managed through the BTCPay platform. The attacker moved funds out of the compromised account, prompting the community response.

The bounty offers a financial incentive for the return of stolen funds or for actionable information that leads to recovery. Organizers set conditions that require verifiable return of funds or proof linking the theft to a specific vulnerability. They also require maintainers be allowed to inspect and patch affected deployments before any returned funds are redistributed. Organizers have not disclosed the size of the bounty or the identities of the main contributors.

BTCPay is an open-source, self-hosted payment processor used by merchants and developers to accept bitcoin without relying on traditional payment processors. The project is volunteer driven and its community includes developers, merchants and individual donors who support infrastructure, security audits and development work. Community members moved quickly to coordinate technical and financial responses after the incident was reported.

Developers have not published technical details of the exploit. Current work focuses on verifying the scope of the breach, securing affected deployments and preventing similar incidents on other instances of the software. Independent contributors and merchants advised operators of self-hosted instances to review access controls, update to the latest recommended releases, rotate keys and credentials, audit recent changes to server configuration, and check for unusual transactions.

The community framed the bounty as a short-term measure to recover assets and to encourage responsible disclosure of information that would aid investigation. Investigations are ongoing, and the project plans to publish a fuller account of the incident and any fixes once findings have been verified.