Blockstream has officially declined to pay a bounty to the attackers who exploited its Liquid sidechain on September 6. The incident involved a software vulnerability that allowed the unauthorized creation of Liquid tokens, resulting in the drainage of approximately 4,000 BTC from the network.
Following a software patch, the attackers returned 3,400 BTC but retained 598.5 BTC, currently valued at roughly $46 million. They subsequently requested a retroactive bug bounty, a practice that has become common in the crypto industry following similar incidents, such as the Nomad bridge hack in 2022.
Blockstream maintains that the unauthorized seizure of assets constitutes theft rather than responsible disclosure. The company argues that open-source developers should not be expected to fund payouts that exceed their own network stake. Charles Guillemet, CTO of Ledger, supported this stance.
The company is not alone in this approach, as Kraken also labeled similar actions as extortion earlier in 2024. As of now, nearly 600 BTC remain missing. Blockstream has not disclosed how the loss will be covered, noting that recovery efforts are now in the hands of law enforcement and forensics experts.
