The BTCPay Server community is offering a maximum bounty of 3 bitcoin to recover funds lost in an exploit of a critical vulnerability discovered in the Lightning Network Daemon (LND) integration, according to the announcement posted August 10, 2026.
The bounty structure caps the reward at 3 BTC or 10 percent of recovered funds, whichever is smaller. The vulnerability affected the handling of macaroon authentication credentials in LND, a critical component used to secure Lightning Network payments. BTCPay Server identified the flaw on August 7, 2026, after attackers exploited it to access funds on affected instances.
BTCPay Server is a free, open-source payment processor used by merchants to accept bitcoin and altcoins without intermediaries. The project has no central company; it operates through community governance and receives funding via donations. Thousands of merchants globally use BTCPay to process transactions.
The LND macaroon vulnerability allowed attackers who gained access to a server to forge authentication tokens and drain Lightning channels. Macaroons are bearer credentials issued by LND to authorize payments and channel management; they function as cryptographic proof of permission rather than passwords. The vulnerability required either direct server access or exploitation of a separate weakness to retrieve the macaroon in the first place.
BTCPay advised affected users to rotate their macaroons immediately and upgrade to patched versions. The community bounty comes from coordination among stakeholders to incentivize recovery of stolen funds and information about the exploit's scope. No public figure has yet claimed the reward, and the total amount of funds lost remains unconfirmed.
Recovery bounties in cryptocurrency incidents typically aim to identify stolen assets on-chain and negotiate return agreements with attackers or their intermediaries. The 3 BTC bounty at current rates exceeds typical bug bounties for payment infrastructure. Whether the reward succeeds depends on whether anyone with knowledge of stolen amounts and actor identity comes forward.
