Bloomberg reporter Emily Nicolle argues that the crypto industry should prioritize structured bug bounty programs over post-exploit negotiations. This follows the recent incident involving the Liquid Network, where attackers drained $320 million in Bitcoin between September 6 and September 8, 2026.
During the event, hackers returned approximately $266.5 million after on-chain negotiations. However, they retained about 598.5 BTC, valued at roughly $47 million, as a self-awarded bounty. Nicolle describes this as a troubling precedent where attackers dictate their own compensation.
The author distinguishes between black, white, and gray hat hackers, noting that the current industry practice of negotiating with gray hats blurs the line between security research and extortion. Such incidents create credibility issues and legal risks for protocols as global regulators increase their scrutiny.
To counter this, Nicolle suggests that projects must implement robust bounty programs that offer rewards competitive with potential exploit gains. While platforms like Immunefi have paid out over $143 million to researchers by July 2026, these amounts remain small compared to individual exploits.
The $47 million kept by the Liquid Network attackers serves as an example of the high cost of lacking a sufficient proactive security strategy. Establishing formal disclosure channels provides a clearer legal framework and discourages the exploitation of vulnerabilities for profit.
