Blockstream Refuses Hacker’s $50M Bounty, 600 BTC at Risk

Blockstream has refused a request to pay nearly 600 bitcoin, about $50 million, after a hacker returned 3,400 BTC of roughly 3,996 stolen from the Liquid network. The company declined a 10% bounty demand and on Sept. 11 announced it will pursue the remaining coins through law enforcement, exchanges, service providers and forensic investigators.

The exploit occurred on Sept. 6 when a vulnerability allowed the minting of unbacked L-BTC and the withdrawal of about 3,996 real BTC via SideSwap. After Blockstream patched affected nodes, the attacker returned 3,400 BTC and demanded the 10% bounty be paid from Blockstream’s funds, warning holders could face about a 15% shortfall otherwise.

Blockstream called the attacker’s request unacceptable and has asked for the remaining coins to be returned. Chief executive Adam Back wrote that the L-BTC-to-BTC peg will ultimately be one-for-one and urged holders not to sell at a discount while the federation conducts a security review.

SideSwap reported the attacker ran about 70 rehearsal transactions before producing the unbacked L-BTC. On-chain traces show the initiating wallet received funds traced through a cross-chain bridge to Tornado Cash. SideSwap described the incident as a “deliberate and prepared attack” and provided Blockstream with traceable leads; it also returned its transaction fee and called for the Bitcoin to be returned.

The refusal to pay has prompted debate in the crypto community. Lorenzo Romagnoli described Blockstream as “already in the 1% of the 1% of luckiest hacked protocols on the planet” and argued the company achieved a recovery outcome few projects see. Samson Mow challenged the attacker’s method for calculating a bounty, noting the network’s total asset value mixes different issuers’ holdings and should not determine a reward.

Blockchain researchers are monitoring a wallet holding about 598.5 BTC. Analysts say moving the coins through exchanges or custodians could reveal new leads, making them difficult to spend without detection. Alex Waltz suggested the holder might keep the funds unspent to exert economic pressure or await negotiation.

SideSwap markets have reopened and the federation has resumed producing blocks, but peg-ins and peg-outs remain suspended while the reserve shortfall is addressed or the missing coins are recovered. SideSwap will keep its peg service offline until a new security architecture is introduced and will disclose changes before reopening. Blockstream has not detailed how it would finance the gap if the coins are not returned or when full redemptions will resume.