We're donating 0.21 BTC to @craigraw and 0.21 BTC to the Bitcoin Red Team for their responsible security disclosure of the recent critical vulnerability. In addition, friends and supporters of the BTCPay Server project have committed to funding a bounty to recover the stolen funds. The bounty will be 10% of the amount recovered, up to a maximum of 3 BTC for full recovery of the funds. These are modest contributions, but they are what we can offer as a FOSS project and a way to appreciate people doing critical security work, which helps the entire ecosystem. To anyone with actionable information that could lead to a recovery, including the attacker, please contact: security@btcpayserver.org. Signal and other secure communication channels can be provided upon request. If multiple reports contribute to the recovery, the bounty will be split in coordination with the victims, based on the amount each victim lost, the funds recovered, how useful the information was to the recovery efforts, and other relevant factors.