{"id":13142,"date":"2026-09-12T07:22:27","date_gmt":"2026-09-12T07:22:27","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=13142"},"modified":"2026-09-12T07:22:27","modified_gmt":"2026-09-12T07:22:27","slug":"blockstream-bets-600-bitcoin-by-rejecting-liquid-hackers-50-million-bounty-demand","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=13142","title":{"rendered":"Blockstream bets 600 Bitcoin by rejecting Liquid hacker\u2019s $50 million bounty demand"},"content":{"rendered":"

<\/p>\n

\n

Blockstream is refusing to pay the Liquid attacker nearly 600 Bitcoin (roughly $50 million), escalating a dispute over how the crypto industry should reward\u00a0partial restitution.<\/p>\n

The standoff follows an unusual recovery from the Sept. 6 exploit, when a vulnerability allowed the attacker to create about 4,000 unbacked L-BTC and withdraw roughly 3,996 real BTC through SideSwap.<\/p>\n

The attacker returned 3,400 BTC after Blockstream patched affected nodes, then demanded a 10% bounty paid from Blockstream\u2019s own funds and warned that holders could otherwise bear a roughly 15% shortfall.<\/p>\n

\"Blockstream\"Blockstream
Table compiles on-chain messages attributed to the Liquid hackers and Blockstream, including PGP-signed exchanges and transactions connected to the return of 3,400 BTC. Source: Galaxy Research<\/figcaption><\/figure>\n

On Sept. 11, Blockstream rejected the demand and said it would pursue the remaining funds through law enforcement, exchanges, service providers, and forensic specialists if they are not voluntarily returned.<\/p>\n

The decision has opened a broader argument over whether refusing to compensate an attacker who returned about 85% of the haul strengthens deterrence or gives the next hacker less reason to return anything.<\/p>\n

Blockstream’s rare recovery turns into a fight over incentives<\/h2>\n

The return of 3,400 BTC shifted the fight from recovering stolen funds to defining what cooperation after an exploit is worth.<\/p>\n

Lorenzo Romagnoli, co-founder of USDT0, said Blockstream had already received an outcome that most hacked crypto protocols could only hope for. He argued that an attacker linked to North Korea or another committed criminal group would have little incentive to voluntarily send back hundreds of millions of dollars.<\/p>\n

Romagnoli said:<\/p>\n

\n

\u201cBlockstream is already in the 1% of the 1% of luckiest hacked protocols on the planet.\u201d<\/p>\n<\/blockquote>\n

He said Blockstream retains every right to identify and prosecute the attacker, but warned that refusing a substantial bounty could change future hackers’ calculations. A grey-hat attacker weighing whether to return stolen funds may see little upside in cooperation if restitution brings the same pursuit as keeping the entire haul.<\/p>\n

That argument collides with Blockstream\u2019s concern that paying would create a different incentive: allowing an attacker to exploit open-source infrastructure, seize user assets and then establish the price for returning them.<\/p>\n

Blockstream said it would not establish a precedent in which developers of open-source software could be forced to pay a demand that \u201cfar exceeds their economic participation.\u201d It also rejected the attacker\u2019s white-hat characterization and urged the party to \u201creturn the Bitcoin.\u201d<\/p>\n

\n

Related Reading<\/span><\/p>\n

Tokens created out of thin air may explain how $320 million in Bitcoin left the Liquid sidechain<\/h3>\n<\/p>\n

<\/span> <\/div>\n

Samson Mow, a former Blockstream chief strategy officer and chief executive of Bitcoin company Jan3, also challenged the economics behind the attacker\u2019s demand.<\/p>\n