# BTCPay Server Pledges Up to 3 Bitcoin to Recover Funds Drained From Merchant Lightning Nodes

The theft follows Boltz suspending its swap service on August 3, citing automated probing assisted by artificial intelligence (AI), a shutdown that left several wallets without swaps until Blockstream announced a second implementation.

- Published: 2026-08-11T05:53:59.872Z
- Canonical: https://polylog.news/crypto/2026-08-11/btcpay-server-pledges-up-to-3-bitcoin-to-recover-funds-drain
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [Bitcoin Magazine](https://bitcoinmagazine.com/news/btcpay-server-offers-bitcoin-bounty), [Bitcoin Magazine](https://bitcoinmagazine.com/news/blockstream-debuts-bitcoin-swaps-lightning), [Blockstream Blog](https://blog.blockstream.com/announcing-blockstream-swaps/)

BTCPay Server, the open-source payment processor that merchants self-host to accept bitcoin, is [funding a recovery bounty worth 10% of any returned funds, capped at 3 bitcoin](https://bitcoinmagazine.com/news/btcpay-server-offers-bitcoin-bounty), after attackers drained Lightning nodes run by its users. The project has said it will prioritize security patches over new features.

The root cause was an access-control failure rather than a flaw in bitcoin itself. BTCPay installations expose access to the node through credential files known as macaroons, and a defect let a remote party obtain those credentials without authorization. With them, an attacker could force channels closed and move the coins out. The defect only affects setups running the most widely used Lightning node software (LND), and BTCPay's own on-chain and hot wallets were not affected. The project shipped version 2.4.2 on August 7 and paid 0.42 bitcoin to the researchers who reported the flaw. It has not published a total loss figure or a victim count, so the size of the theft remains unknown.

Four days earlier, Boltz, which ran the swap service that moved value between the main chain, Lightning and Liquid for several independent wallets, suspended operations indefinitely. Boltz attributed the decision to a pattern of automated probing of its infrastructure and said attackers now iterate faster than a team its size can find and patch defects. Because its design is self-custodial, it said user funds were never at risk. Aqua, Bull Bitcoin and Zeus lost swap functionality within hours, and Blockstream disabled swaps inside its own wallet.

Blockstream responded by [building and launching a second implementation](https://blog.blockstream.com/announcing-blockstream-swaps/), Blockstream Swaps, which it describes as moving value between bitcoin's layers without a custodian in the middle. Its stated reason is the concentration problem the outage exposed. [When one provider goes offline, swaps stop working across unrelated wallets at once](https://bitcoinmagazine.com/news/blockstream-debuts-bitcoin-swaps-lightning).

Two conclusions follow from these events. Bitcoin's base layer held, and the failures occurred in the volunteer-maintained software and single-vendor services layered above it. And the discovery of defects in that layer is getting faster than the small teams maintaining it can respond, which is the specific claim both BTCPay and Boltz have made in public.

## What this means

Merchants and small operators who self-custody through open-source infrastructure carry the loss when maintainers are outpaced, and there is no insurer or clearing member behind them. The channel of exposure is operational, not monetary: every additional automated review pass raises the discovery rate of latent defects in code that thousands of installations already run. That pushes risk-averse holders toward custodial products and regulated wrappers, and it pushes independent infrastructure toward redundancy, which is what Blockstream's second swap implementation is. Either maintainers get funded and audited fast enough to keep pace, or self-hosted bitcoin infrastructure keeps shrinking to the operators who can afford in-house security.

## What to watch

- Whether any of the drained Lightning funds are returned under the BTCPay bounty, which would show whether reward offers work against attackers who already hold the coins.
- Whether Boltz resumes service or other teams follow Blockstream in building competing swap providers, since a single provider going dark again would break swaps across multiple wallets simultaneously.
- The rate of critical advisories in widely deployed bitcoin and Lightning software over the coming weeks, which indicates whether the recent cluster is a backlog being cleared or a sustained increase.