Blockstream Refuses to Pay Hackers Who Expected a 10% Cut

Blockstream has said no to paying the attackers who stole funds from its Liquid sidechain. The decision breaks from a common crypto practice where self-proclaimed white hat hackers keep a portion of what they take.

Liquid, a network built by Blockstream, lets users lock Bitcoin (BTC) and receive a faster-moving token in return. Attackers took about 4,000 BTC on September 6 after exploiting a software flaw.

Why White Hat Hackers Learned to Expect a Cut

The vulnerability allowed the attackers to create Liquid tokens that were not backed by real Bitcoin and then convert them. Federation signing keys were never compromised, which is why the draining transaction cleared as usual.

After Blockstream fixed the software, the attackers returned 3,400 BTC. They then asked for a retroactive bug bounty and kept 598.5 BTC, worth roughly $46 million at current Bitcoin prices.

That request follows a pattern. In 2022, Nomad, a bridge that lost $190 million, publicly offered hackers a 10% cut of the stolen funds in exchange for returning the rest. Other projects have adopted similar arrangements since.

Blockstream Says the White-Hat Label Does Not Fit

Blockstream stated that open-source developers should not fund payouts far larger than their own investment in a network.

Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is theft.

Charles Guillemet, Chief Technology Officer at Ledger, had questioned the white hat claim days earlier. He argued that attackers who drain a bridge and then invite contact are not doing security research.

Blockstream is not the first to refuse. In 2024, Kraken accused security researchers of extortion after they took $3 million and set their own terms for returning it.

BeInCrypto reported on September 7 that the partial return still left nearly 600 BTC outstanding. That gap remains, and Blockstream has not said publicly who covers the loss if the coins do not come back.

Recovery now depends on law enforcement, exchanges, and blockchain forensics targeting unidentified actors. Whether the refusal holds will influence what the next attackers demand.