Blockstream Refuses $50 Million Bounty Demand from Liquid Hacker

A hacker exploited a vulnerability in the Liquid sidechain on September 6, creating around 4,000 unbacked L-BTC and withdrawing roughly 3,996 real BTC. The attacker returned 3,400 BTC after Blockstream patched affected nodes, then demanded a 10% bounty paid from Blockstream's own funds.

The demand, worth around $50 million, was met with refusal by Blockstream, which stated it would pursue the remaining funds through law enforcement and forensic specialists if they are not voluntarily returned. This decision has sparked debate over whether refusing to compensate an attacker who returned 85% of the haul strengthens deterrence or gives future hackers less reason to return anything.

Lorenzo Romagnoli, co-founder of USDT0, argued that Blockstream had already received a rare and fortunate outcome in recovering most of the stolen funds. He warned that refusing a substantial bounty could change future hackers' calculations, making cooperation less attractive if restitution brings the same pursuit as keeping the entire haul.