Blockstream will not pay the attackers who drained its Liquid sidechain. The refusal breaks with a crypto habit of letting self-declared white hat hackers keep a slice of what they took.

Liquid is a Blockstream-built network where users lock Bitcoin (BTC) and receive a matching token that moves faster. Attackers exploited a software flaw on September 6 and took roughly 4,000 BTC.

Why White Hat Hackers Learned to Expect a Cut

The flaw let the attackers create Liquid tokens that no real Bitcoin backed, then convert them out. Federation signing keys were never stolen, which is why the transaction that drained Liquid cleared normally.

They later returned 3,400 BTC once Blockstream patched the software, then asked for a retroactive bug bounty. They kept 598.5 BTC, worth about $46 million at current Bitcoin prices.

That demand follows a script. Nomad, a bridge that lost $190 million in 2022, publicly offered hackers 10% of the haul to send the rest back. Projects have copied the arrangement since.

Blockstream Says the White-Hat Label Does Not Fit

Blockstream said in its statement that open-source developers should not fund payouts far larger than their own stake in a network.

Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is theft.

Ledger Chief Technology Officer Charles Guillemet questioned the white hat claim days earlier. Attackers who empty a bridge and then invite contact are not doing security research, he argued.

The company is not alone in refusing. Kraken accused security researchers of extortion in 2024 after they took $3 million and set their own price for returning it.

BeInCrypto reported on September 7 that the partial return still left nearly 600 BTC outstanding. That gap has not closed, and Blockstream has not said publicly who absorbs it if the coins never come back.

Recovery now rests on law enforcement, exchanges, and chain forensics aimed at actors nobody has identified. Whether the refusal holds will shape what the next attacker asks for.

Source: BeInCrypto