Blockstream Draws Line in Sand on Ransom Payment
Blockstream has refused to pay a ransom of approximately $47 million after recovering 85% of stolen BTC from a Liquid Network exploit. The company claims that negotiating with attackers is theft, not responsible disclosure.
The exploit targeted a software bug in the Elements codebase, allowing attackers to create unbacked L-BTC tokens and swap them for real BTC. The multi-signature security model remained intact, but the logic flaw allowed the exploitation of peg transactions.
Blockstream deployed patches quickly and recovered 3,400 BTC by September 7, with the remaining 598.5 BTC still at large. On-chain negotiations turned hostile, with attackers initially demanding a 10% bounty for full return of the stolen funds before escalating to threats of a 15% loss if Blockstream didn't comply.
Blockstream rejected the label of white hats and characterized the episode as theft, citing that white hats disclose vulnerabilities responsibly. The company has engaged law enforcement agencies and forensic specialists to recover the remaining funds through legal channels.