BTCPay Server is donating 0.21 BTC to
@craigraw and 0.21 BTC to the Bitcoin Red Team for responsibly disclosing a critical vulnerability.
They're also putting up a bounty for recovering the stolen funds, 10% of whatever is recovered, up to 3 BTC max.
If you have info that could help recover the funds, contact security
@btcpayserver.org.