Liquid sidechain

September 12 2026

Blockstream refuses $50 million bounty demand and risks 600 Bitcoin in Liquid security breach

BlockWest News Team Digital Assets, Security & Hacks Bitcoin security, Blockstream, cryptocurrency exploit, Liquid sidechain, ransom negotiation

Blockstream’s refusal to pay a $50 million bounty demand from the Liquid sidechain attacker has triggered a broader debate over how the crypto industry should incentivize partial fund recovery versus deterring future exploits. The standoff tests whether penalizing cooperation discourages future hackers from returning stolen assets or simply shifts the cost of security failures onto users.

Attacker demanded 10% bounty on roughly 600 BTC after voluntarily returning 3,400 BTC from September 6 exploit
Blockstream rejected demand, stating it would pursue remaining funds through law enforcement and forensic specialists instead
Liquid’s reserve coverage dropped to approximately 85% after attack, leaving core L-BTC-to-BTC peg temporarily impaired

600 BTC Remaining stolen funds from Liquid sidechain attack, equivalent to $50 million
3,400 BTC Amount voluntarily returned by attacker after Blockstream patched vulnerable nodes
85% Reserve coverage of L-BTC after returned Bitcoin was credited back to federation
Sept. 6 Date of exploit allowing attacker to create 4,000 unbacked L-BTC and withdraw real Bitcoin

Blockstream is standing firm against demands for a substantial ransom payment following a partial recovery from the September 6 exploit that struck its Liquid sidechain. The attacker created approximately 4,000 unbacked L-BTC tokens and withdrew roughly 3,996 real BTC through SideSwap, the main peg-out service on Liquid. After Blockstream patched vulnerable nodes, the attacker voluntarily returned 3,400 BTC but then demanded a 10% bounty paid from Blockstream’s funds, warning that Liquid holders could otherwise face a roughly 15% shortfall on their L-BTC redemptions.

The Liquid sidechain operates as a layer-two solution for Bitcoin, enabling faster transactions and confidential transfers while maintaining a peg to the underlying asset. Users deposit Bitcoin to receive L-BTC tokens backed by a federation of custodians managed by Blockstream and other participants. The security of this peg depends on the integrity of the federation’s reserve management and the cryptographic protocols protecting the sidechain’s consensus mechanism. The September exploit exposed vulnerabilities in that architecture, raising questions about how well-protected Bitcoin-backed sidechains remain against determined attackers.

Blockstream Rejects Bounty, Vows Law Enforcement Pursuit

On September 11, Blockstream announced it would not pay the roughly 600 BTC bounty and instead pursue the remaining funds through law enforcement, cryptocurrency exchanges, service providers, and forensic analysis. The company stated it would not establish a precedent in which developers of open-source software could be forced to pay demands that “far exceeds their economic participation.” Blockstream rejected the attacker’s characterization as a white-hat security researcher and urged the party to return the Bitcoin voluntarily.

The decision has opened a contentious debate within the industry over incentives and moral hazard. Lorenzo Romagnoli, co-founder of USDT0, noted that Blockstream had already achieved an outcome “most hacked crypto protocols could only hope for,” arguing that an attacker linked to state-sponsored or organized criminal groups would have little reason to voluntarily return hundreds of millions in stolen assets.

Blockstream is already in the 1% of the 1% of luckiest hacked protocols on the planet.

Lorenzo Romagnoli, Co-founder, USDT0

Romagnoli warned, however, that refusing a substantial bounty could alter future attackers’ incentive calculations, potentially discouraging cooperation on similar partial recoveries. This tension between establishing precedent and achieving practical recovery outcomes has become a recurring challenge as cryptocurrency platforms face increasingly sophisticated attacks.

SideSwap Disputes White-Hat Status, Cites Deliberate Preparation

SideSwap, which processed the unauthorized withdrawals, disputed the attacker’s characterization as a white-hat researcher. The exchange noted that the party executed 70 similar test transactions before successfully creating the unbacked L-BTC, indicating deliberate preparation rather than accidental discovery. This pattern of behavior suggests the attacker conducted extensive reconnaissance, potentially over weeks, to understand exactly how Liquid’s node infrastructure handled peg-outs and where vulnerabilities existed.

Additionally, the wallet that initiated the attack received funding traced through a cross-chain bridge to Tornado Cash, a mixing service frequently used to obscure asset provenance. SideSwap called the event a “deliberate and prepared attack” and stated it had returned its fees on the transaction while standing with Blockstream’s position. The involvement of Tornado Cash suggests potential premeditation or involvement by actors with experience concealing financial tracks in cryptocurrency transactions.

Samson Mow, former Blockstream chief strategy officer and CEO of Bitcoin company Jan3, also challenged the economics of the bounty demand, arguing that the attacker had based its calculation on Liquid’s total asset value of roughly $5 billion, which includes L-BTC, Tether, and real-world assets issued by different parties and thus does not represent Blockstream’s economic exposure. Under this analysis, Blockstream faced pressure to pay ransom based on a valuation that conflated multiple issuers’ exposure with its own.

Remaining Bitcoin May Serve Long-Term Pressure Rather Than Spend

Bitcoin researcher Alex Waltz raised the possibility that the attacker may have no intention of moving the remaining 598.5 BTC through identifiable channels. The wallet is closely watched, and moving the coins through exchanges, custodians, or other regulated services could provide investigators with additional leads. Waltz suggested the attacker now faces a strategic choice: return everything and hope for a generous Blockstream reward, or retain the portion as a means of continued economic pressure even if the coins cannot be readily spent.

The remaining Bitcoin already exerts measurable pressure on Liquid’s operations. As of September 10, 4,205 L-BTC remained in circulation while the federation reserve held 3,597 BTC, resulting in approximately 85% reserve coverage. Blockstream Chief Executive Adam Back said the L-BTC-to-BTC peg will ultimately achieve one-for-one coverage and urged holders not to sell at a discount, but the company has not yet disclosed how it will finance the shortfall if the attacker refuses to return the funds.

The economic pressure on Liquid holders is real and immediate. Any user holding L-BTC faces potential losses if they attempt to redeem their tokens before Blockstream resolves the reserve gap. This dynamic creates secondary pressure on Blockstream to settle with the attacker, even as the company maintains its public stance of non-negotiation. Markets often price in tail risks, and L-BTC trading discounts would reflect the probability that holders may not recover full Bitcoin value.

Liquid has resumed producing blocks and SideSwap markets have reopened, but peg-ins and peg-outs remain disabled while the federation completes a security review. SideSwap announced it will keep its peg service offline until the federation introduces a new security architecture and will disclose those changes before resuming operations. Until either the coins return or the reserve gap is filled through other means, Liquid’s core promise of converting L-BTC back into Bitcoin at parity remains suspended.

Blockstream’s next move depends on tracing the remaining BTC and identifying whoever controls the wallet. The company has not detailed whether it will seek to finance the roughly 600-BTC gap from its own balance sheet or recover it through legal and forensic channels, nor has it specified when full L-BTC redemptions will resume on Liquid’s network. The outcome of this standoff could influence how other blockchain projects respond to future exploits and ransom demands.

September 10 2026

Liquid Hackers Label Blockstream as Delusional, Greedy, and Arrogant While Seeking 10% Bounty

BlockWest News Team Bitcoin, Digital Assets, Security & Hacks Bitcoin bridge vulnerability, Blockstream security, cryptocurrency bug bounty, Liquid sidechain, white-hat hackers

A dispute between Blockstream and parties claiming white-hat hacker status has escalated sharply, with demands for a 10% bounty on roughly $5 billion in secured assets. The conflict highlights security vulnerabilities in the Liquid sidechain and raises questions about bug bounty norms and threat credibility in the digital asset ecosystem.

Hackers demanded 10% bounty from Blockstream’s own funds after claiming company allocated only $1.5 million to secure $5 billion in assets.
Roughly 4,000 BTC worth around $320 million was withdrawn from Liquid’s Federation wallet on September 6, with 598 units still held by the hackers.
Blockstream has kept Liquid paused while addressing security fixes, chain split issues, and preparing coordinated network restart.

$5B Assets that Blockstream allegedly secured with minimal dedicated funding
598 BTC Remaining amount held by hackers after 3,400 BTC was returned
$320M Value of 4,000 BTC withdrawn on September 6 at the time
$1.5M Amount allegedly allocated by Blockstream to secure the five billion dollars

Understanding the Liquid Sidechain’s Role and Value

Liquid is a sidechain built on Bitcoin that enables faster transactions and enhanced privacy features for users and institutional participants. The network operates through a federated consensus model where multiple participants maintain bridge nodes that secure the movement of Bitcoin between the main chain and Liquid. This architecture allows Bitcoin to be locked on the main blockchain while an equivalent amount is issued on Liquid, creating a wrapped representation that can be traded with lower latency and fees.

The sidechain has attracted significant institutional interest and daily transaction volumes, making the security of its bridge infrastructure critical to the broader Bitcoin ecosystem. Federation members include major cryptocurrency exchanges and infrastructure providers who collectively ensure that Bitcoin entering the system can be reliably retrieved by users.

The Escalating Confrontation

The confrontation between Blockstream and the party claiming responsibility for the Liquid bridge breach has intensified as new demands emerge from the actors who withdrew approximately 4,000 BTC from the Federation wallet on September 6. According to messages relayed by Samson Mow, the hackers have characterized Blockstream’s security posture as negligent, pointing to a significant disparity between the value of assets at risk and the resources devoted to protecting them. The group has issued a formal demand for a 10% bounty drawn from company funds, while simultaneously threatening that failure to comply could result in losses of approximately 15% for Liquid users.

Hackers Escalate Rhetoric Against Blockstream’s Security Response

The messaging from the party holding the stolen funds has grown increasingly confrontational, describing Blockstream’s approach to security as “flagrant neglect” and characterizing the company itself as “delusional, greedy, and arrogant.” The accusations center on what the hackers view as grossly inadequate investment in safeguarding tens of billions of dollars worth of user assets flowing through the Liquid sidechain. This framing represents a departure from the initial posture adopted when the funds were first withdrawn, when the actors described themselves as white-hat researchers and framed the theft as a security demonstration.

The hackers have also indicated they plan to release the private key for decrypting their communications once the bounty dispute concludes.

Industry Context and Vulnerability Disclosure Norms

The cryptocurrency and broader technology sectors have developed established practices for responsible vulnerability disclosure. White-hat security researchers typically report exploits privately to affected organizations, allowing time for fixes before public disclosure. Industry norms generally discourage taking assets as leverage during the disclosure process, though some researchers have historically used modest proof-of-concept withdrawals to demonstrate real-world impact.

The amounts involved in this incident significantly exceed typical bug bounty payouts in the industry, even for critical vulnerabilities. This disparity forms a core part of the hackers’ argument that Blockstream’s standard bounty allocation is insufficient given the scale of assets protected by the vulnerable system.

Blockstream’s Measured Response and Network Status

Blockstream and Federation members have maintained the Liquid sidechain in a paused state while implementing additional security fixes and resolving a chain split that emerged during the incident. Users have been advised to refrain from sending Bitcoin to Liquid peg-in addresses until the network restoration is complete. The initial withdrawal on September 6 triggered immediate action from the company, which confirmed that bridge nodes had been patched within a relatively short timeframe.

Following that confirmation, the hackers returned 3,400 BTC to the Federation wallet, representing the majority of the stolen amount, while retaining approximately 598 BTC as what appears to be leverage in negotiations. This staged return suggested an intent to demonstrate the vulnerability without causing permanent loss, consistent with white-hat disclosure practices, though the subsequent demand for compensation has muddied that narrative.

Mow Warns Hackers of Long-Term Legal and Practical Exposure

Samson Mow, former Chief Strategy Officer of Blockstream, has publicly cautioned the group behind the incident that their position may be more precarious than they believe. He highlighted that Blockstream’s willingness to communicate through PGP encryption represented a courtesy that could be withdrawn, and he questioned the strategic wisdom of publicly admitting to the theft and then making financial demands. Mow suggested the actors have left behind evidence that could prove consequential and that attempting to return funds does not necessarily provide an exit from legal or regulatory scrutiny.

His warnings reflect the ambiguous legal territory these incidents occupy. Taking control of assets without authorization, even as a security demonstration, can constitute theft under applicable law regardless of the actor’s intent or subsequent offer to return the funds. Regulatory agencies have increasingly scrutinized such incidents, particularly when public threats are involved.

As a white hat, the road only widens; as a black hat, you’re forever on edge. Dreaming of walking away with assets unscathed is nothing but delusion. Some doors, once opened, can never be closed again.

Samson Mow, Former Blockstream Chief Strategy Officer

Implications for Future Vulnerability Disclosure

The dispute now hinges on whether Blockstream will engage with the bounty demand and whether the hackers will follow through on threats to escalate damage to the network. The outcome may establish precedent for how exchanges and custodians respond to security disclosures that blur the line between legitimate vulnerability research and theft with conditions.

Should Blockstream accede to demands, it could create incentives for future threat actors to employ similar tactics. Conversely, a firm refusal could potentially encourage the group to make good on threats, creating immediate disruption to users and other Federation participants who depend on Liquid’s operation.

September 7 2026

Suspected Security Researchers Extract $320 Million in Bitcoin From Liquid Network While Pledging to Return Stolen Assets After Settlement

BlockWest News Team Bitcoin, Digital Assets, Security & Hacks Bitcoin security, blockchain exploit, Blockstream, cryptocurrency hack, Liquid sidechain

A $320 million Bitcoin theft from the Liquid sidechain has thrown the network into an extended outage, with alleged white-hat hackers claiming they will restore funds once Blockstream patches a claimed vulnerability. The incident raises questions about network security, federation custody, and whether the perpetrators are genuine researchers or sophisticated attackers using white-hat language as cover.

Approximately 4,000 BTC, valued at roughly $320 million, was withdrawn from the Liquid Federation wallet via the SideSwap PAK.
The alleged hackers communicated exclusively through on-chain Bitcoin transaction messages and refused to engage through conventional private security channels.
Blockstream temporarily disabled bridge nodes and paused the Liquid sidechain while investigating the breach and negotiating with the perpetrators.

4,000 BTC Amount of Bitcoin withdrawn from Liquid Federation wallet
$320M Approximate value of the stolen Bitcoin at time of theft
3,998.5 BTC Remaining unmoved balance as of final public communication
$625M Size of Ronin bridge hack for comparison to similar incidents

The Liquid Network, a Bitcoin sidechain designed to facilitate faster transactions and enhanced privacy, experienced a significant security breach when unknown actors extracted approximately 4,000 BTC from the federation’s custody reserves. Blockstream, which operates core infrastructure for Liquid, confirmed that the theft occurred through the SideSwap Peg-out Authorization Key but stressed that the key itself was not compromised and no other federation keys face immediate risk. The Liquid Federation maintains Bitcoin reserves that back LBTC, the network’s Bitcoin-pegged asset, which serves institutional users and digital asset platforms seeking to issue tokens on a Bitcoin-based layer.

Liquid represents one of the more established Bitcoin sidechain solutions, having launched in 2018 with a focus on institutional adoption and confidential transactions. The network relies on a federation model where multiple parties hold custody keys collectively, requiring threshold signatures to authorize major transactions. This approach differs from centralized bridges but introduces custodial risk, as the recent theft demonstrates. The breach highlights ongoing challenges in securing multi-party custody arrangements, particularly when managing large reserves of high-value assets.

Hackers Initiate Public On-Chain Dialogue With Blockstream

Rather than following standard security disclosure practices, the perpetrators identified themselves as white-hat hackers and initiated contact through unconventional means. At 11:30 AM PDT, they posted a message via Bitcoin transaction data stating “we are whitehats. contact us on chain” and requested communication through Signal at @m671aw.70. Blockstream initially attempted to redirect them toward private channels by asking them to contact its security team by email and later sent an encrypted, PGP-signed message.

The alleged hackers refused to engage privately and maintained exclusive use of on-chain messaging for all subsequent communications. This departure from established vulnerability disclosure norms raised immediate red flags within the security community. At 7:20 PM PDT, they signaled intent to return most of the funds and asked whether a specified address would be acceptable for transfer. Approximately one hour later, they claimed a network bug needed to be fixed first, emphasizing the ongoing risk to chain integrity.

The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix.

Alleged hackers, in on-chain message to Blockstream

Blockstream acknowledged the request at 8:30 PM PDT with a brief “Yes, thank you,” appearing to accept the hackers’ terms for remediation.

Network Containment And Skepticism Over White-Hat Claims

Blockstream took immediate action to limit the breach’s scope by temporarily disabling bridge nodes and pausing the Liquid sidechain during the investigation. Crypto exchanges were notified and began suspending or preparing to suspend deposits and withdrawals of LBTC. Other assets on the network, including USDT, DePix, and real-world assets, remained unaffected, suggesting the incident was isolated to the federation’s Bitcoin reserves rather than representing a systemic vulnerability affecting all Liquid-based tokens.

The rapid coordination between Blockstream and exchanges reflects established practices in the industry following major security incidents. Pausing bridge operations prevented additional fund withdrawals while negotiations continued and investigation proceeded. This containment strategy prioritizes preventing further damage over maintaining normal network operations, a decision prioritizing user asset security over service continuity.

Security professionals within the cryptocurrency industry have questioned the legitimacy of the white-hat narrative. Charles Guillemet, CTO of Ledger, noted that authentic security researchers typically follow established vulnerability disclosure protocols emphasizing private communication rather than public fund transfers and on-chain negotiations. Guillemet drew parallels to the Ronin hack, in which attackers stole approximately $625 million after compromising validator keys, and the Euler exploit, where the attacker negotiated the return of stolen funds following a theft.

The distinction between genuine white-hat researchers and sophisticated attackers adopting white-hat language remains difficult to verify in cryptocurrency incidents. Authentic security researchers typically work through coordinated disclosure frameworks that prioritize protecting user funds while allowing developers time to patch vulnerabilities. Public communication via on-chain messages bypasses these safeguards and increases risk exposure. Legitimate researchers also typically do not retain custody of stolen funds pending patch deployment, as this arrangement creates counterparty risk and unusual incentive structures.

Guillemet acknowledged that criminal actors rarely contact victims after a theft, adding an additional layer of uncertainty to the incident’s true nature.

As of 9:12 PM PDT, approximately 3,998.5 BTC remained unmoved in the hackers’ possession, and no further messages were exchanged between the parties. The cryptocurrency community awaits confirmation that Blockstream has patched the alleged vulnerability and whether the perpetrators will follow through on their stated commitment to return the stolen funds. This incident underscores broader questions about federation security models and custodial arrangements in decentralized finance, particularly regarding how institutional infrastructure manages large asset concentrations.