Forward Deployed Engineer

Blockstream bets 600 Bitcoin by rejecting Liquid hacker's $50 million bounty demand. The fight over the remaining $46 million is splitting crypto over whether rewarding partial restitution encourages cooperation or invites extortion. Senior Reporter - CryptoSlate Sep. 12, 2026 Quick take. * 01 Blockstream rejected the Liquid attacker's demand for nearly 600 BTC after 3,400 BTC was returned following the September exploit. * 02 The dispute pits deterrence against restitution, as paying could reward attacks while refusing may reduce incentives for future hackers to cooperate. * 03 Liquid remains about 85% reserve-backed, with peg-ins and peg-outs disabled while Blockstream traces the remaining funds or fills the gap. Blockstream is refusing to pay the Liquid attacker nearly 600 Bitcoin (roughly $50 million), escalating a dispute over how the crypto industry should reward partial restitution. The standoff follows an unusual recovery from the Sept. 6 exploit, when a vulnerability allowed the attacker to create about 4,000 unbacked L-BTC and withdraw roughly 3,996 real BTC through SideSwap. The attacker returned 3,400 BTC after Blockstream patched affected nodes, then demanded a 10% bounty paid from Blockstream's own funds and warned that holders could otherwise bear a roughly 15% shortfall. On Sept. 11, Blockstream rejected the demand and said it would pursue the remaining funds through law enforcement, exchanges, service providers, and forensic specialists if they are not voluntarily returned. The decision has opened a broader argument over whether refusing to compensate an attacker who returned about 85% of the haul strengthens deterrence or gives the next hacker less reason to return anything. Blockstream's rare recovery turns into a fight over incentives. The return of 3,400 BTC shifted the fight from recovering stolen funds to defining what cooperation after an exploit is worth. Lorenzo Romagnoli, co-founder of USDT0, said Blockstream had already received an outcome that most hacked crypto protocols could only hope for. He argued that an attacker linked to North Korea or another committed criminal group would have little incentive to voluntarily send back hundreds of millions of dollars. Romagnoli said: "Blockstream is already in the 1% of the 1% of luckiest hacked protocols on the planet." He said Blockstream retains every right to identify and prosecute the attacker, but warned that refusing a substantial bounty could change future hackers' calculations. A grey-hat attacker weighing whether to return stolen funds may see little upside in cooperation if restitution brings the same pursuit as keeping the entire haul. That argument collides with Blockstream's concern that paying would create a different incentive: allowing an attacker to exploit open-source infrastructure, seize user assets and then establish the price for returning them. Blockstream said it would not establish a precedent in which developers of open-source software could be forced to pay a demand that "far exceeds their economic participation." It also rejected the attacker's white-hat characterization and urged the party to "return the Bitcoin." Samson Mow, a former Blockstream chief strategy officer and chief executive of Bitcoin company Jan3, also challenged the economics behind the attacker's demand. The attacker had criticized Blockstream for allegedly spending too little to protect roughly $5 billion in assets issued across Liquid. Mow said that figure combines L-BTC, Tether, and real-world assets that belong to different issuers and holders, making the network's total asset value an inappropriate basis for determining a bounty. "Bounty amounts cannot be calculated based on the network's overall total value. Regardless of how the rest is negotiated, all users' assets must be returned in full." The circumstances preceding the withdrawal have also complicated the attacker's white-hat claim. SideSwap said the party spent hours rehearsing the transaction pattern before creating the unbacked L-BTC, with 70 similar transactions preceding the successful mint. The wallet used to initiate the attack had received funding that traced through a cross-chain bridge to Tornado Cash. In view of this, SideSwap called the event a "deliberate and prepared attack," while adding that: "We stand with Blockstream. The bitcoin left the Liquid reserve through our peg-out service and we have given Blockstream everything we have to help trace and recover it. Our fee on it is already returned. Return the Bitcoin." The last 600 BTC may be more useful unspent. With the bounty rejected, the remaining 598.5 BTC can continue putting pressure on Liquid even if the coins never move. Bitcoin researcher Alex Waltz questioned whether the attacker genuinely expects to spend the coins. According to him, the wallet is closely watched, and moving the BTC through exchanges, custodians, or other identifiable services could provide investigators with additional leads. That creates another possible motive for keeping the funds. Waltz said the attacker effectively faced two choices after returning most of the haul: return everything and hope Blockstream provides a generous reward, or retain a portion that may be difficult to spend but can continue inflicting an economic cost on Liquid. "If the hackers are somewhat well off, and had a good reason to hate Blockstream/Liquid, it seems the only way they can 'monetize' this situation is to keep the 600 BTC." He also raised the possibility that investigators could eventually obtain clues from artificial intelligence services used by the attacker if models were accessed through identifiable API accounts, though no evidence has emerged publicly showing that such services were used. The economic pressure is already visible on Liquid. SideSwap said on Sept. 10 that 4,205 L-BTC remained in circulation while the federation reserve held 3,597 BTC, leaving about 85% reserve coverage after the returned bitcoin was added back. Liquid has resumed producing blocks and SideSwap markets have reopened, but peg-ins and peg-outs remain disabled while the federation completes its security review. Blockstream Chief Executive Adam Back said the L-BTC-to-BTC peg will ultimately be covered one-for-one and urged holders not to sell at a discount. Blockstream has yet to detail how it will finance the roughly 600-BTC gap if the attacker refuses to return the funds, or when it will resume full redemptions. Meanwhile, SideSwap has said it will keep its peg service offline until the federation introduces a new security architecture and will disclose the changes before reopening it. Blockstream's alternative path now depends on tracing the remaining BTC and identifying whoever controls it. Until either the coins return or the reserve hole is filled from elsewhere, Liquid's markets can trade again while its core promise of converting L-BTC back into Bitcoin remains suspended. Market Signal Bullish 68 / 100 $77,355.57 0.46% 1H 0.05% 24H 0.46% 7D 2.83% 30D 21.67% 60D 23.24% 90D 19.87% Market cap $1.55T Volume (24h) $30.86B 4.45% Circ. supply 20.08M FDV $1.62T

Blockstream takes a stand against ransom for stolen bitcoin. What if the very foundation of your investment was under siege? This question resonates loudly following Blockstream's striking decision to reject a ransom for nearly 600 BTC stolen from its Liquid Network. This incident serves as a glaring reminder of the security vulnerabilities lurking within the cryptocurrency realm, particularly for investors and exchanges in Southeast Asia. As discussions about operational integrity and transparency within decentralized finance (DeFi) grow louder, Blockstream's stance against capitulating to ransom demands ignites crucial discourse about the responsibilities that come with cryptocurrency stewardship. The Liquid Network breach explained. On September 6, 2026, a sophisticated breach struck Blockstream's Liquid Network when hackers discovered and exploited a serious flaw in its transaction-validation software. The immediate repercussions were staggering; around 4,000 BTC were siphoned from the federation wallet in a heartbeat, halting operations and disrupting liquidity for a multitude of dependent users. While negotiations led to the recovery of around 3,400 BTC, the lingering absence of 600 BTC underscores serious questions regarding the trustworthiness of involved parties and the operational future of the Liquid Network itself. Blockstream's defiant position on ransom payments. In a powerful declaration released on September 11, Blockstream made its position clear, vehemently rejecting any negotiations over ransom. Their stance? "Taking assets without authorization and withholding their return is a crime, not responsible disclosure." This marks a pivotal shift - choosing a path of legal pathways over capitulating to criminal demands. By characterizing the theft in stark terms, Blockstream not only sets a new benchmark within the cryptocurrency landscape but also illuminates the murky waters of accountability in decentralized frameworks. The impact on Southeast Asia's growing crypto fabric. With over 700 million people in Southeast Asia engaging with cryptocurrencies, the implications of the Liquid Network debacle are momentous. The region has endured its share of phishing scams, leading to growing trepidation among traders. As Blockstream seeks legal avenues to recover its stolen funds, users and exchanges must tread cautiously. This incident serves as a sobering reminder of how security breaches can rattle market dynamics and invite additional scrutiny into the cryptocurrency ecosystem. Rethinking risk management in the DeFi sphere. Blockstream's firm refusal to comply with ransom requests is a clarion call to reassess risk management tactics regarding cryptocurrency theft and asset recovery. Historically, ransom payments were viewed as a quick fix for asset retrieval, yet they often pave the way for more lawlessness. Blockstream's stance inspires a shift towards transparency and accountability, laying the groundwork for vital discussions about forging stronger security protocols in cryptocurrency ventures, including decentralized autonomous organizations (DAOs). Legal action in the battle against crypto crime. Is it possible that collaborating with law enforcement could yield more favorable outcomes than bowing to ransom demands in the cryptocurrency underworld? Blockstream's approach suggests this might indeed be the case. Teaming up with law enforcement and blockchain forensic experts may not only provide pathways for asset recovery but also instill a stronger deterrent against future violations. By clearly delineating between theft and responsible disclosures, the crypto community can aspire to elevate security standards while nurturing trust in the management of digital assets. Moving forward: recovery strategies and new guidelines. The Liquid incident presents critical challenges regarding custody and the evolution of blockchain technology. Experts suggest that a collaborative, community-driven strategy could be pivotal for effective asset recovery. Engaging ethical hackers and blockchain analysis specialists may yield invaluable insights into tracing the disparate BTC and ultimately enhancing the decentralized financial landscape. As the Liquid Network gears up to resume operations, maintaining transparency with regular updates will be crucial, especially concerning the status of the missing funds. Conclusion. Blockstream's resolute refusal to entertain ransom demands could fundamentally alter the cryptocurrency narrative, potentially recalibrating expectations for how incidents are managed. As DeFi continues to navigate uncharted waters, the focus must transition from merely reacting to crises to implementing proactive legal frameworks and fostering communal responsibility. Stakeholders across Southeast Asia and the globe must stay alert, aware of emerging threats while advocating for fortified security practices. In the fast-paced arena of cryptocurrency, the enduring impact of Blockstream's bold stance may not only shape future security protocols but also redefine the very essence of asset recovery. This is a critical juncture, rich with lessons to be learned and obstacles still to overcome. The story unfolds, and its influence on cryptocurrency security and norms is a narrative we all must watch closely. Article by Last updated September 12, 2026 Get started with Crypto in minutes! Get started with Crypto effortlessly. OneSafe brings together your crypto and banking needs in one simple, powerful platform.

Crypto hack: Blockstream rejects ransom as nearly 600 Bitcoin remains missing. CryptoWorld September 11, 2026 Crypto News 3 minutes read Blockstream has refused to pay for the return of Bitcoin after a theft from the Liquid Network because it believes that security researchers should not steal! Most of the funds have already been returned, but nearly 600 BTC, which is worth about $47 million, remains with the people behind the attack. How the Liquid Network hack unfolded. The incident began when attackers found a flaw in software used by Liquid, a Bitcoin-based network designed to support faster transfers and other financial services. Through the weakness, around 4,000 Liquid Bitcoins were generated, which were then exchanged for the real Bitcoin on the network. They [the attackers] described what they did as "white-hat" activity, and about 3,400 BTC was returned afterwards. But Blockstream said that the negotiation it had before with the people behind it was just to get users' funds back, and that it should not be interpreted as accepting their actions or demands. Blockstream draws a line over the remaining bitcoin. In a public statement, Blockstream declared that it would not be paying a ransom to recover the remaining funds. Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is theft. Blockstream said they were not going to pay, stating that paying would create a bad precedent for those who develop open-source software. Instead, it promised to aid law enforcement, exchanges, and BTC blockchain investigators to find the BTC that had not yet been seized and trace those responsible for the attacks. Blockstream ended the statement with a direct demand: "Return the bitcoin." Bitcoin community questions Blockstream's position. The refusal has divided some members of the Bitcoin community. Whale Coin Talk wondered if the situation could have been worse still and pointed out that the funds were returned, so it was an actual white hat, as another group might never have given them back. Seems like white-hat hackers are doing a better job than protocols at keeping users safe. Others focused on Blockstream's responsibility for the vulnerability. Kurt Wuckert Jr. summarized that criticism by writing: Code is law when it benefits CryptoWorld, but law is law when its code gets people robbed. All these do not answer the questions of whether the attackers are security researchers, and show why the case became more than a crypto hack. It also raises the issue of when unauthorized testing can be called extortion. Final summary. * Blockstream says it will not pay for the return of nearly 600 BTC still held by the attackers. * The partial return of approximately 3,400 BTC has caused disagreement over whether the incident involved white-hat research or theft.