Blockstream refuses bounty after Liquid exploit

TLDR

Blockstream is refusing to pay a 10% white-hat bounty after the Liquid Network exploit, leaving roughly 600 BTC unrecovered and rejecting ransom-style negotiations.

1. Attackers exploited Liquids software to drain about 4,000 BTC, later returning 3,400 BTC while keeping around 598.5 BTC and demanding a retroactive bounty.
2. Blockstream calls the action theft, not responsible disclosure, and argues that paying would set a damaging precedent for open-source Bitcoin infrastructure.
3. Liquid users face ongoing peg-out restrictions and uncertainty over who absorbs any shortfall, while Blockstream pursues legal and forensic recovery of the remaining BTC.

Deep Dive

1. What Happened In The Liquid Exploit

Liquid is a Bitcoin sidechain where users lock BTC and receive a pegged token (L-BTC) that moves faster with added privacy. On 6 Sep, attackers exploited a vulnerability in the Elements software that allowed them to create about 4,000 unbacked L-BTC and swap it for real BTC from the federation wallet, draining roughly $320 million worth of Bitcoin at the time, without stealing federation keys. Reports note that 3,400 BTC was returned to the federation after emergency patches, leaving about 598.5 BTC, or 15% of the haul, still missing and only around 85% of L-BTC fully backed by BTC reserves as peg-outs remain disabled while recovery continues, according to Liquids incident update and coverage in sources like The Defiant.

2. Why Blockstream Refused The Bounty

After returning most of the BTC, the actors demanded a 10% bounty from Blockstreams own funds and framed their actions as white-hat security research. Blockstream publicly rejected this, stating that taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is theft, and adding that Bitcoin users should not be haircut to fund a ransom, as detailed in its statement summarized by Crypto.news. This stance breaks with a growing pattern where exploited projects offer about 10% of stolen funds as a bounty, such as the Nomad bridge case, highlighted in analysis of this incident by Yahoo Finance.

3. User Impact And What To Watch Next

For Liquid users, block production and transactions have resumed, but BTC peg-outs remain paused and L-BTC is only partially backed until the remaining BTC is recovered or some other resolution is announced, as noted in the ongoing recovery coverage by Cointelegraph. Blockstream says the attackers still have a chance to return the bitcoin, but if they do not, the company will work with law enforcement, exchanges, and forensic firms to trace coins and identify those responsible. More broadly, the incident is fueling skepticism about federated sidechains and bridges that rely on complex software plus small governance groups, and it is likely to harden attitudes toward paying ransoms.

Risk note: Sidechain and bridge exposure concentrates technical and governance risk; a single bug can cause reserve drains, long pauses, and counterparty uncertainty.

Confidence: high because multiple independent news outlets and Blockstreams own statement report consistent timelines, amounts, and quotes.

Conclusion

Blockstreams refusal to pay a bounty after the Liquid exploit draws a clear line between responsible disclosure and theft, even when attackers return most of the funds. The unresolved 598.5 BTC keeps Liquid partially undercollateralized and peg-outs constrained, underscoring how sidechain and bridge failures can strand capital. For crypto users, the key signals to watch are Liquids progress on restoring full backing and peg-out functionality, and whether other projects follow Blockstreams example by rejecting ransom-style white-hat demands in future exploits.