Blockstream Declines $50 Million Bounty After Liquid Attack Returns Most Funds
Blockstream refuses bounty after partial return
Blockstream announced it will not pay the attacker who returned 3,400 BTC after the September 6 exploit on the Liquid sidechain. The attacker had asked for a 10% bounty—about 600 BTC, roughly $50 million—claiming the remainder of the funds would cause a 15% shortfall for holders.
Key facts
- The September 6 vulnerability let the attacker create roughly 4,000 unbacked L‑BTC and withdraw about 3,996 real BTC via SideSwap.
- After Blockstream patched the affected nodes, the attacker returned 3,400 BTC.
- Blockstream rejected the bounty demand on September 11 and said it would pursue the remaining funds through law enforcement and forensic specialists.
- Liquid’s reserve now covers about 85% of the L‑BTC in circulation; peg‑ins and peg‑outs remain disabled pending a security review.
Blockstream's official response
Blockstream said paying the bounty would set a precedent that open‑source developers could be forced to compensate attackers beyond their economic participation. The company urged the attacker to return the remaining Bitcoin and warned it would involve exchanges, service providers, and law‑enforcement agencies if the funds are not voluntarily returned.
Expert commentary
- Lorenzo Romagnoli, co‑founder of USDT0, called Blockstream “one of the luckiest hacked protocols” and warned that refusing a large bounty could change future attackers’ calculations.
- Samson Mow, former Blockstream chief strategy officer, argued that a bounty should not be based on the network’s total asset value (about $5 billion) and that all users’ assets must be returned in full.
- SideSwap, the service used for the peg‑out, described the attack as “deliberate and prepared,” noted that the attacker’s wallet was funded through a cross‑chain bridge to Tornado Cash, and pledged to help trace the remaining funds.
- Bitcoin researcher Alex Waltz suggested the attacker may keep the remaining ~600 BTC because moving it would be closely watched and could provide investigators with leads.
Liquid's current reserve status
After the returned BTC was added back, the federation reserve holds 3,597 BTC while 4,205 L‑BTC remain in circulation, giving about 85% reserve coverage. Blockstream CEO Adam Back said the L‑BTC‑to‑BTC peg will eventually be covered one‑for‑one and urged holders not to sell at a discount. Peg‑ins and peg‑outs stay disabled while the federation completes its security review.
Implications for security incentives
The dispute highlights a tension between deterrence—refusing to reward attackers—and restitution—encouraging partial returns. Blockstream argues that paying a bounty could motivate future exploits, while some experts warn that a lack of reward might discourage attackers from returning stolen funds.
Future actions
Blockstream plans to trace the remaining ~600 BTC and will work with law‑enforcement and forensic specialists if the coins are not returned voluntarily. SideSwap will keep its peg service offline until the federation introduces a new security architecture. Liquid’s markets can trade, but the ability to convert L‑BTC back to Bitcoin remains suspended until the reserve gap is filled.
