Blockstream Blocks White Hat Cut for Liquid Hackers
Blockstream has refused to pay the attackers who drained its Liquid sidechain in an unprecedented move that breaks with a long-standing crypto habit. The hackers exploited a software flaw on September 6, taking approximately 4,000 BTC. They later returned 3,400 BTC after Blockstream patched the vulnerability and demanded a retroactive bug bounty, keeping 598.5 BTC worth about $46 million at current Bitcoin prices.
The attackers' demand for a 10% cut follows a script that has become common in the crypto industry. Nomad, a bridge that lost $190 million in 2022, publicly offered hackers 10% of the haul to send the rest back, and projects have since copied this arrangement.
Blockstream disputes the attackers' self-declared status as white hat hackers, arguing that taking assets without authorization and withholding their return is a crime, not responsible disclosure. The company cites open-source developers should not fund payouts far larger than their own stake in a network.