The project said it will pay 10% of recovered funds, up to 3 BTC, after attackers stole LND credentials and drained merchant Lightning wallets last week.

BTCPay told users running LND to update immediately or take servers offline after attackers stole credentials that can control Lightning wallets and move funds.

BTCPay Server vulnerability let attackers drain merchant Lightning nodes by exploiting persistent credentials, hitting Foundation and Citadel21