Blockstream Refuses 600 BTC Bounty Demand After Liquid Hack

Blockstream has officially rejected a demand from a hacker to pay a 600 Bitcoin bounty. The dispute stems from a September exploit on the Liquid network, where an attacker created unbacked tokens and withdrew thousands of real Bitcoin. While the attacker eventually returned 3,400 Bitcoin, they kept roughly 600 Bitcoin and requested a payment equal to 10 percent of the total haul as a reward for their cooperation.

Blockstream dismissed the request, stating it will not set a precedent that allows attackers to extort open source developers. The firm argues that paying would encourage future exploits, as it effectively lets criminals set their own price for returning stolen property. Instead, Blockstream is coordinating with forensic specialists and law enforcement to recover the remaining funds.

Industry experts remain divided on the outcome. Some suggest that rejecting the bounty might discourage future hackers from returning stolen funds, effectively turning the attackers into permanent holdouts. Others agree with Blockstream, noting that the attacker spent hours practicing the exploit, which contradicts any claim of being a helpful white hat researcher.

For now, the remaining 600 Bitcoin remain in a closely watched wallet. While the funds are likely difficult for the attacker to spend without triggering alerts at exchanges, their presence continues to put economic pressure on the Liquid network. Liquid has resumed block production, though certain features like peg ins and peg outs remain offline as the team conducts a full security review.