Blockstream Refuses Bounty on 598.5 BTC Kept After Liquid Sidechain Drain

4,000 BTC Taken From Liquid Sidechain

Blockstream has flatly refused to pay the retroactive bounty demanded by the hackers who drained its Liquid sidechain earlier this month. Liquid is a Blockstream-built network in which users lock Bitcoin (BTC) and receive a matching token that settles faster on-chain; on September 6, attackers exploited a software flaw to create Liquid tokens backed by no real Bitcoin, then converted them out through the peg. Federation signing keys were never stolen, which is why the draining transactions cleared without obstruction. In total, roughly 4,000 BTC left the network. Once Blockstream shipped a patch, the attackers sent back 3,400 BTC and asked to be compensated as if the episode were a formal bug bounty engagement, keeping 598.5 BTC for themselves — a stash worth about $46 million with Bitcoin trading near $77,952 at press time. In its official statement, which we reviewed directly, Blockstream argued that open-source developers should not be forced to fund payouts far larger than their own stake in the network, calling the seizure of assets and the withholding of their return “a crime, not responsible disclosure” — not white-hat activity, but theft. The company broke with a convention that has hardened across crypto since 2022, when self-declared white hats learned they could keep a slice of what they took and still be thanked publicly. What remains unresolved is the missing balance: the partial return still leaves nearly 600 BTC outstanding, and Blockstream has not disclosed who absorbs the shortfall if the coins never come back.

official statementhttps://x.com/Blockstream/status/2098281867908690394

The 10% Bounty Precedent

The demand itself followed a script the industry wrote for itself. Nomad, a cross-chain bridge that lost $190 million in a chaotic 2022 exploit, publicly offered the hackers 10% of the haul to send the rest back, and projects copied the arrangement thereafter — turning a one-off negotiation into an expected tariff on stolen funds. Days before Blockstream's refusal, Ledger Chief Technology Officer Charles Guillemet questioned the white-hat framing altogether, arguing that actors who empty a bridge and then invite contact are running a shakedown, not doing security research. Blockstream is not the first to push back, either: in 2024, Kraken accused security researchers of extortion after they took $3 million and set their own price for returning it, a dispute that chilled the sector's tolerance for self-priced returns. The open question is where the remaining funds travel next. Recovery now depends on law enforcement, exchange compliance teams and chain forensics chasing wallets nobody has publicly identified — actors who can push the coins through a crypto mixer or into privacy-focused assets such as Monero (XMR) to break the trace. That work funnels through major trading venues, and the compliance readiness of the best crypto exchanges will likely decide whether the withheld BTC is ever frozen. Our reading of the technical record is that the blast radius was narrower than the headline suggests: no keys were compromised, and the flaw sat in token issuance, containing the damage to the peg rather than the underlying Bitcoin reserves. Readers tracking the market in real time can follow live spot and futures prices on MEXC.

What the Refusal Signals

Read together, the two threads mark an inflection point. The primary document here is Blockstream's own statement: it reclassifies a practice the industry had quietly normalized as theft, and dares the next attacker to price that in. Whether the refusal holds will shape what the next group asks for — and whether federated custody models, positioned between raw transparency and privacy techniques such as zero-knowledge proofs, can withstand the reputational leverage attackers now wield. The episode also echoes maximal extractable value debates, where protocols effectively pay to avoid being exploited; this time, the invoice arrived after the fact. Expect more hard lines, and fewer quiet 10% settlements.