The offer is open to anyone with useful information, including the attacker. The project asked people to write to its security address and said secure channels are available on request.
If several reports lead to a recovery, the bounty will be split with the victims according to how much each lost and how useful the information proved.
We're donating 0.21 BTC to @craigraw and 0.21 BTC to the Bitcoin Red Team for their responsible security disclosure of the recent critical vulnerability. In addition, friends and supporters of the BTCPay Server project have committed to funding a bounty to recover the stolen… pic.twitter.com/qhs8zwoCvM
The project is also paying the researchers who found the flaw, donating 0.21 BTC each to developer Craig Raw and to the Bitcoin Red Team fund.
Attackers exploited the vulnerability last week to obtain credentials for LND, the most widely used software for running a Lightning node, and to drain the wallets associated with it.
Hardware-wallet maker Foundation and the bitcoin publication Citadel21 both reported losing funds. Neither BTCPay nor the victims have published a total so far.
In a separate post , BTCPay said exchanges, blockchain analytics firms and law enforcement have offered help tracing the money, and urged affected merchants to report the theft to local police and to any service the funds are traced to.
The Bitcoin Red Team is the volunteer effort that began pointing AI models at bitcoin codebases this month and has filed thousands of findings across hundreds of projects, including the report that led to this patch.
Meanwhile, BTCPay advised merchants to keep funds in cold storage and move excess out of hot wallets regularly, "especially during this period of rapid, AI-driven change."