Blockstream Rejects Hacker's $50M Bounty Demand, Stoking Debate Over Rewards and Deterrence

Blockstream, the company behind the Liquid sidechain, has refused to pay a $50 million bounty demanded by hackers who exploited a vulnerability on September 6. The attackers created around 4,000 unbacked L-BTC and withdrew roughly 3,996 real BTC through SideSwap before returning 3,400 BTC after Blockstream patched affected nodes.

The hacker then demanded a 10% bounty be paid from Blockstream's own funds, warning that holders could otherwise bear a roughly 15% shortfall. Blockstream rejected the demand and said it would pursue the remaining funds through law enforcement, exchanges, service providers, and forensic specialists if they are not voluntarily returned.

Lorenzo Romagnoli, co-founder of USDT0, argued that Blockstream had already received an outcome that most hacked crypto protocols could only hope for. He said Blockstream retains every right to identify and prosecute the attacker but warned that refusing a substantial bounty could change future hackers' calculations.