Blockstream Refuses the 10% Cut White Hat Hackers Have Learned to Expect
Blockstream will not pay the attackers who drained its Liquid sidechain. The refusal breaks with a crypto habit of letting self-declared white hat hackers keep a slice of what they took. Liquid is a Blockstream-built network where users lock Bitcoin (BTC) and receive a matching token that moves faster. Attackers exploited a software flaw on September 6 and took roughly 4,000 BTC. Why White Hat Hackers Learned to Expect a Cut The flaw let the attackers create Liquid tokens that no real Bitcoin backed, then convert them out. Federation signing keys were never stolen, which is why the transaction that drained Liquid cleared normally. Sponsored Sponsored They later returned 3,400 BTC once Blockstream patched the software, then asked for a retroactive bug bounty. They kept 598.5 BTC, worth about $46 million at current Bitcoin prices. That demand follows a script. Nomad, a bridge that lost $190 million in 2022, publicly offered hackers 10% of the haul to send the rest back. Projects have copied the arrangement since. Blockstream Says the White-Hat Label Does Not Fit Blockstream said in its statement that open-source developers should not fund payouts far larger than their own stake in a network. Taking assets without authorization and withholding their return is a crime, not responsible disclosure.









