Marketing Coordinator

Blockstream bets 600 Bitcoin by rejecting Liquid hacker's $50 million bounty demand. The fight over the remaining $46 million is splitting crypto over whether rewarding partial restitution encourages cooperation or invites extortion. Senior Reporter - CryptoSlate Sep. 12, 2026 Quick take. * 01 Blockstream rejected the Liquid attacker's demand for nearly 600 BTC after 3,400 BTC was returned following the September exploit. * 02 The dispute pits deterrence against restitution, as paying could reward attacks while refusing may reduce incentives for future hackers to cooperate. * 03 Liquid remains about 85% reserve-backed, with peg-ins and peg-outs disabled while Blockstream traces the remaining funds or fills the gap. Blockstream is refusing to pay the Liquid attacker nearly 600 Bitcoin (roughly $50 million), escalating a dispute over how the crypto industry should reward partial restitution. The standoff follows an unusual recovery from the Sept. 6 exploit, when a vulnerability allowed the attacker to create about 4,000 unbacked L-BTC and withdraw roughly 3,996 real BTC through SideSwap. The attacker returned 3,400 BTC after Blockstream patched affected nodes, then demanded a 10% bounty paid from Blockstream's own funds and warned that holders could otherwise bear a roughly 15% shortfall. On Sept. 11, Blockstream rejected the demand and said it would pursue the remaining funds through law enforcement, exchanges, service providers, and forensic specialists if they are not voluntarily returned. The decision has opened a broader argument over whether refusing to compensate an attacker who returned about 85% of the haul strengthens deterrence or gives the next hacker less reason to return anything. Blockstream's rare recovery turns into a fight over incentives. The return of 3,400 BTC shifted the fight from recovering stolen funds to defining what cooperation after an exploit is worth. Lorenzo Romagnoli, co-founder of USDT0, said Blockstream had already received an outcome that most hacked crypto protocols could only hope for. He argued that an attacker linked to North Korea or another committed criminal group would have little incentive to voluntarily send back hundreds of millions of dollars. Romagnoli said: "Blockstream is already in the 1% of the 1% of luckiest hacked protocols on the planet." He said Blockstream retains every right to identify and prosecute the attacker, but warned that refusing a substantial bounty could change future hackers' calculations. A grey-hat attacker weighing whether to return stolen funds may see little upside in cooperation if restitution brings the same pursuit as keeping the entire haul. That argument collides with Blockstream's concern that paying would create a different incentive: allowing an attacker to exploit open-source infrastructure, seize user assets and then establish the price for returning them. Blockstream said it would not establish a precedent in which developers of open-source software could be forced to pay a demand that "far exceeds their economic participation." It also rejected the attacker's white-hat characterization and urged the party to "return the Bitcoin." Samson Mow, a former Blockstream chief strategy officer and chief executive of Bitcoin company Jan3, also challenged the economics behind the attacker's demand. The attacker had criticized Blockstream for allegedly spending too little to protect roughly $5 billion in assets issued across Liquid. Mow said that figure combines L-BTC, Tether, and real-world assets that belong to different issuers and holders, making the network's total asset value an inappropriate basis for determining a bounty. "Bounty amounts cannot be calculated based on the network's overall total value. Regardless of how the rest is negotiated, all users' assets must be returned in full." The circumstances preceding the withdrawal have also complicated the attacker's white-hat claim. SideSwap said the party spent hours rehearsing the transaction pattern before creating the unbacked L-BTC, with 70 similar transactions preceding the successful mint. The wallet used to initiate the attack had received funding that traced through a cross-chain bridge to Tornado Cash. In view of this, SideSwap called the event a "deliberate and prepared attack," while adding that: "We stand with Blockstream. The bitcoin left the Liquid reserve through our peg-out service and we have given Blockstream everything we have to help trace and recover it. Our fee on it is already returned. Return the Bitcoin." The last 600 BTC may be more useful unspent. With the bounty rejected, the remaining 598.5 BTC can continue putting pressure on Liquid even if the coins never move. Bitcoin researcher Alex Waltz questioned whether the attacker genuinely expects to spend the coins. According to him, the wallet is closely watched, and moving the BTC through exchanges, custodians, or other identifiable services could provide investigators with additional leads. That creates another possible motive for keeping the funds. Waltz said the attacker effectively faced two choices after returning most of the haul: return everything and hope Blockstream provides a generous reward, or retain a portion that may be difficult to spend but can continue inflicting an economic cost on Liquid. "If the hackers are somewhat well off, and had a good reason to hate Blockstream/Liquid, it seems the only way they can 'monetize' this situation is to keep the 600 BTC." He also raised the possibility that investigators could eventually obtain clues from artificial intelligence services used by the attacker if models were accessed through identifiable API accounts, though no evidence has emerged publicly showing that such services were used. The economic pressure is already visible on Liquid. SideSwap said on Sept. 10 that 4,205 L-BTC remained in circulation while the federation reserve held 3,597 BTC, leaving about 85% reserve coverage after the returned bitcoin was added back. Liquid has resumed producing blocks and SideSwap markets have reopened, but peg-ins and peg-outs remain disabled while the federation completes its security review. Blockstream Chief Executive Adam Back said the L-BTC-to-BTC peg will ultimately be covered one-for-one and urged holders not to sell at a discount. Blockstream has yet to detail how it will finance the roughly 600-BTC gap if the attacker refuses to return the funds, or when it will resume full redemptions. Meanwhile, SideSwap has said it will keep its peg service offline until the federation introduces a new security architecture and will disclose the changes before reopening it. Blockstream's alternative path now depends on tracing the remaining BTC and identifying whoever controls it. Until either the coins return or the reserve hole is filled from elsewhere, Liquid's markets can trade again while its core promise of converting L-BTC back into Bitcoin remains suspended. Market Signal Bullish 68 / 100 $77,355.57 0.46% 1H 0.05% 24H 0.46% 7D 2.83% 30D 21.67% 60D 23.24% 90D 19.87% Market cap $1.55T Volume (24h) $30.86B 4.45% Circ. supply 20.08M FDV $1.62T

Crypto hack: Blockstream rejects ransom as nearly 600 Bitcoin remains missing. CryptoWorld September 11, 2026 Crypto News 3 minutes read Blockstream has refused to pay for the return of Bitcoin after a theft from the Liquid Network because it believes that security researchers should not steal! Most of the funds have already been returned, but nearly 600 BTC, which is worth about $47 million, remains with the people behind the attack. How the Liquid Network hack unfolded. The incident began when attackers found a flaw in software used by Liquid, a Bitcoin-based network designed to support faster transfers and other financial services. Through the weakness, around 4,000 Liquid Bitcoins were generated, which were then exchanged for the real Bitcoin on the network. They [the attackers] described what they did as "white-hat" activity, and about 3,400 BTC was returned afterwards. But Blockstream said that the negotiation it had before with the people behind it was just to get users' funds back, and that it should not be interpreted as accepting their actions or demands. Blockstream draws a line over the remaining bitcoin. In a public statement, Blockstream declared that it would not be paying a ransom to recover the remaining funds. Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is theft. Blockstream said they were not going to pay, stating that paying would create a bad precedent for those who develop open-source software. Instead, it promised to aid law enforcement, exchanges, and BTC blockchain investigators to find the BTC that had not yet been seized and trace those responsible for the attacks. Blockstream ended the statement with a direct demand: "Return the bitcoin." Bitcoin community questions Blockstream's position. The refusal has divided some members of the Bitcoin community. Whale Coin Talk wondered if the situation could have been worse still and pointed out that the funds were returned, so it was an actual white hat, as another group might never have given them back. Seems like white-hat hackers are doing a better job than protocols at keeping users safe. Others focused on Blockstream's responsibility for the vulnerability. Kurt Wuckert Jr. summarized that criticism by writing: Code is law when it benefits CryptoWorld, but law is law when its code gets people robbed. All these do not answer the questions of whether the attackers are security researchers, and show why the case became more than a crypto hack. It also raises the issue of when unauthorized testing can be called extortion. Final summary. * Blockstream says it will not pay for the return of nearly 600 BTC still held by the attackers. * The partial return of approximately 3,400 BTC has caused disagreement over whether the incident involved white-hat research or theft.