BTCPay Server offers 3 bitcoin bounty for stolen funds recovery

BTCPay Server is offering a 3 bitcoin bounty to anyone who can help recover funds stolen in a recent wallet exploit. The open-source payment processor made the announcement after attackers exploited a vulnerability in its wallet software, draining an undisclosed amount of cryptocurrency. The bounty is capped at 3 bitcoins, worth roughly $180,000 at current prices, and will pay 10% of any recovered funds. The company has also pledged to prioritize security fixes over new features indefinitely.

This isn’t the first time BTCPay Server has faced security challenges. Earlier this year, a similar exploit led to the loss of customer funds, prompting calls for stronger protections. The latest breach appears to target a flaw in the wallet’s recovery phrase import function, which attackers used to siphon funds from connected hot wallets. While the exact amount stolen hasn’t been disclosed, the company’s swift response suggests the impact was significant enough to warrant a high-profile bounty.

BTCPay Server’s decision to focus on security reflects growing concerns in the crypto space about wallet vulnerabilities. Unlike traditional payment processors, BTCPay Server relies on community-driven development, which can speed up innovation but also introduce risks. The company has asked affected users to report their losses and provide transaction details to help track the stolen funds. Security researchers and bounty hunters are already investigating the exploit, with some speculating that the attackers may have exploited a known but unpatched vulnerability.

The bounty could set a precedent for how open-source crypto projects handle breaches. If successful, it may encourage more transparency and faster recoveries in the future. BTCPay Server’s move also highlights the broader challenge of balancing innovation with security in decentralized finance. For now, the company is urging users to migrate to cold storage and avoid reusing recovery phrases. The outcome of the bounty—and whether any funds are recovered—could shape how similar incidents are handled in the crypto industry.