BTCPay Server supporters have offered a recovery bounty equal to 10% of funds stolen through a recently disclosed vulnerability in the open-source bitcoin payment processor, capped at 3 BTC if everything is recovered. Attackers extracted Lightning Network admin macaroon credentials from vulnerable instances, prompting the project to publish remediation guidance, appeal even to the attacker for information through a dedicated security address and encrypted channels, and ask affected users to submit on-chain details and file reports that could help exchanges or authorities freeze funds. The BTCPay Server Foundation also pledged 0.21 BTC each to Sparrow Wallet developer Craig Raw and the Bitcoin Red Team fund for responsible disclosure, while the project said exchanges, blockchain analytics firms and law enforcement agencies are helping trace the stolen coins and warned that improving AI tools are making it faster and cheaper to find weaknesses in large codebases.