BTCPay Server is offering a reward of up to 3 BTC, worth around $190,000, for information that helps recover bitcoin stolen from merchants in a recent security attack.

The Bitcoin payments project said Tuesday it will pay 10% of the amount successfully recovered, with the total bounty limited to 3 BTC. Anyone with information that could assist the investigation is eligible, including the attackers themselves.

Individuals with useful leads can reach out through BTCPay’s security contact, and the project said it can arrange encrypted communication for sources who require additional privacy.

Where several reports contribute to the recovery, BTCPay plans to divide the reward among the affected victims. The distribution will be based on the amount each victim lost and how materially each source’s information helped recover the funds.

BTCPay is separately supporting the researchers who identified the vulnerability. It said 0.21 BTC will be donated to developer Craig Raw and another 0.21 BTC to the Bitcoin Red Team for responsibly reporting the flaw.

Attackers exploited the vulnerability last week to obtain credentials associated with LND, one of the most widely used software implementations for operating Lightning Network nodes. The compromised credentials were then used to drain bitcoin from connected merchant Lightning wallets.

Foundation, a hardware-wallet manufacturer, and Bitcoin media outlet Citadel21 have both reported losing funds in the attack. The total value of the stolen bitcoin has not yet been disclosed by BTCPay or the affected victims.

The project said crypto exchanges, blockchain analytics providers and law enforcement agencies are helping track the stolen assets. BTCPay has urged affected merchants to report the incident to local police and contact any services where the stolen bitcoin is identified.

The Bitcoin Red Team is a volunteer security initiative that has recently applied AI tools to review Bitcoin-related software. It has reported thousands of potential vulnerabilities across hundreds of projects, including the issue that led to BTCPay’s latest security fix.

BTCPay is also advising merchants to keep significant balances in cold storage and periodically transfer excess funds out of hot wallets. The project said stronger wallet practices are particularly important as AI-driven changes accelerate across the technology and security sectors.