Blockstream has rejected a demand for a 10% bounty from the group holding roughly 600 BTC left over from last week’s Liquid Network exploit. The company said it will not pay to rec over the remaining Bitcoin and instead urged the actors to return the funds voluntarily.
The dispute follows a Sept. 6 exploit that drained about 4,000 BTC from Liquid’s federation wallet. The stolen coins were worth roughly $320 million at the time. Liquid halted network activity after discovering the incident.
Blockstream Rejects Payment Demand
The actors initially described themselves as white-hat hackers. They returned 3,400 BTC after Blockstream confirmed that affected bridge nodes had received security patches.
However, about 598.5 BTC remains outstanding. At recent market prices, that represents roughly $47 million.
The group later demanded a 10% bounty from Blockstream. It also warned that Liquid users could face a 15% loss if the dispute was not resolved. Blockstream has rejected that proposal.
“Taking assets without authorization and withholding their return is a crime, not responsible disclosure,” Blockstream said in a statement. The company added that it considers the remaining Bitcoin theft rather than a legitimate bug bounty.
Recovery Efforts Continue
Blockstream said it had engaged with the actors in good faith while trying to rec over user funds. However, the company now plans to pursue other avenues if the Bitcoin does not return.
Those efforts could involve law enforcement, cryptocurrency exchanges, service providers and blockchain forensic specialists. The goal would be to trace the remaining Bitcoin and identify those responsible.
The original exploit involved invalid L-BTC being processed through Liquid’s peg-out system. Investigations linked the issue to a software vulnerability rather than a compromise of SideSwap’s authorization key.
Liquid has continued security work following the incident. The network also remains subject to restrictions while developers and federation members prepare a safe restart.
The dispute highlights a growing problem in cryptocurrency security. Attackers can sometimes exploit vulnerabilities, return most of the funds and then seek compensation for the remaining assets. In this case, Blockstream has made clear that it does not recognize the retained Bitcoin as an authorized reward.
