Blockstream Rejects 10% Bounty Demand for 598.5 BTC From Liquid Exploit
Key Takeaways
- •Blockstream refused to pay a 10% bounty demanded by the group holding approximately 598.5 BTC from the Liquid exploit, instead urging the actors to return the funds voluntarily.
- •The Sept. 6 exploit drained roughly 4,000 BTC, worth about $320 million at the time, through invalid L-BTC processed via Liquid's peg-out system, with investigators attributing the incident to a software vulnerability rather than a compromised SideSwap authorization key.
- •The actors initially claimed to be white-hat hackers and returned 3,400 BTC after Blockstream confirmed security patches on the affected bridge nodes, keeping about 598.5 BTC valued near $47 million.
- •Blockstream characterized the unauthorized taking and withholding of assets as a crime rather than responsible disclosure and plans to pursue avenues including law enforcement, cryptocurrency exchanges, service providers and blockchain forensic specialists if the funds are not returned.
- •Liquid halted network activity after the exploit and remains subject to restrictions while developers and federation members prepare for a safe restart.
Blockstream has rejected a 10% bounty demand from the group holding approximately 600 BTC remaining from last week’s exploit of the Liquid Network. The company said it would not pay to recover the Bitcoin and instead urged the actors to return the funds voluntarily.
The dispute follows a Sept. 6 exploit that drained about 4,000 BTC from Liquid’s federation wallet. The stolen Bitcoin was worth roughly $320 million at the time. Liquid halted network activity after discovering the incident.
Blockstream Rejects Payment Demand
The actors initially identified themselves as white-hat hackers. They returned 3,400 BTC after Blockstream confirmed that the affected bridge nodes had received security patches. However, approximately 598.5 BTC remains outstanding. At recent market prices, the remaining Bitcoin was worth roughly $47 million.
The group later demanded a 10% bounty from Blockstream and warned that Liquid users could face a 15% loss if the dispute was not resolved. Blockstream rejected the proposal.
“Taking assets without authorization and withholding their return is a crime, not responsible disclosure,” Blockstream said in a statement. The company added that it considers the remaining Bitcoin to be stolen rather than eligible for a legitimate bug bounty.
Recovery Efforts Continue
Blockstream said it had engaged with the actors in good faith while attempting to recover user funds. The company now plans to pursue other avenues if the Bitcoin is not returned.
Those efforts could involve law enforcement, cryptocurrency exchanges, service providers and blockchain forensic specialists. Their objective would be to trace the remaining Bitcoin and identify those responsible.
The original exploit involved invalid L-BTC being processed through Liquid’s peg-out system. Investigations linked the incident to a software vulnerability rather than a compromise of SideSwap’s authorization key.
Liquid has continued its security work following the exploit. The network also remains subject to restrictions while developers and federation members prepare for a safe restart.
The dispute illustrates a security challenge in cryptocurrency: actors may exploit a vulnerability, return most of the funds and then seek compensation for assets they retain. In this case, Blockstream has made clear that it does not recognize the remaining Bitcoin as an authorized reward.
Source: CryptoMeter
