Liquid Hackers Demand 10% Bounty, Accuse Blockstream of Security Neglect
White-hat hackers escalate conflict with Blockstream over $320M Bitcoin breach.
1The $320M Security Breach
On September 6, approximately 4,000 BTC (worth $320M) was withdrawn from Liquid Network's Federation wallet by parties claiming to be white-hat hackers. Blockstream paused the sidechain as they addressed security vulnerabilities and a chain split. The hackers initially promised to return funds after security patches, but only 3,400 BTC was returned, leaving 598 BTC unaccounted for. This incident exposed critical vulnerabilities in Liquid's infrastructure.
2Hackers' Explosive Accusations
The hackers released a scathing message calling Blockstream 'delusional, greedy, and arrogant' regarding their security practices. They claim Blockstream allocated only $1.5M (or possibly nothing) to secure $5B in assets, calling this 'flagrant neglect.' The group threatened to publish decryption keys for their communications if their demands aren't met. This escalates tensions beyond the initial security incident into a public relations crisis.
3The 10% Bounty Demand
The hackers demand Blockstream pay a 10% bug bounty from company funds, warning that refusal could lead to 15% losses for Liquid users. This equates to $32M based on the $320M breach. The demand comes after Blockstream patched bridge nodes, which the hackers claim was their original condition for returning funds. The remaining 598 BTC appears to be leverage in these negotiations.
4Blockstream's Response
Samson Mow, former Blockstream CSO, warned the hackers may be underestimating consequences. He characterized PGP communications as a 'courtesy' and questioned the wisdom of publicly admitting to taking BTC while demanding payment. Mow suggested the group left more forensic evidence than they realize, hinting at potential legal consequences regardless of fund returns.
5Operational Impact on Liquid
Liquid Network remains paused as Blockstream and Federation members implement additional security fixes. Users are advised against sending Bitcoin to peg-in addresses until operations resume. The extended downtime affects businesses relying on Liquid for faster Bitcoin transactions, potentially damaging trust in the sidechain solution.
6White-Hat or Extortion?
The situation blurs ethical lines - while the hackers claim white-hat intentions, their bounty demand and retained funds resemble extortion. Security experts debate whether this sets a dangerous precedent for blockchain security. The public nature of the conflict makes it a case study in handling major crypto breaches.
7Broader Crypto Security Implications
This incident highlights systemic risks in federated sidechains where security relies on multiple parties. Unlike decentralized networks, federated models create single points of failure. The $320M breach ranks among the largest in crypto history, prompting reevaluation of sidechain security models across the industry.
8What Comes Next
The standoff could lead to three outcomes: negotiated settlement, legal action, or protocol abandonment. Blockstream's response will shape future white-hat interactions industry-wide. Meanwhile, Liquid users face uncertainty about asset security, potentially driving adoption of alternative scaling solutions with different security tradeoffs.