1 week ago
13
Blockstream just drew a line in the sand. After recovering roughly 3,400 BTC from the 4,000 BTC drained from its Liquid Network federation wallet on September 6, the company announced on September 11 that it will not pay a ransom for the remaining 598.5 BTC, worth approximately $47 million.
The company’s position is straightforward: compensating attackers for returning stolen assets is theft negotiation, not responsible disclosure, and doing so would create a playbook for every future exploit in the industry.
What happened on the Liquid Network
The exploit targeted a software bug in the Elements codebase, the open-source framework underpinning Blockstream’s Liquid sidechain. The vulnerability allowed the creation of unbacked L-BTC, the network’s pegged token, which was then swapped for real BTC from the federation wallet.
Critically, this was not a compromise of the federation’s signing keys. The multi-signature security model that governs Liquid’s custody remained intact. The attackers exploited a logic flaw in how the network validated peg transactions.
Blockstream deployed patches quickly, and by September 7, approximately 3,400 BTC had been returned, representing about 85% of the stolen funds. The Liquid Network temporarily suspended operations during the recovery process before resuming with an updated block production program.
On-chain negotiations turned hostile
The back-and-forth between Blockstream and the perpetrators played out in public, conducted through on-chain OP_RETURN messages and PGP-signed Bitcoin transactions.
The attackers initially self-identified as white hats and demanded a 10% bounty from Blockstream for full return of the stolen BTC. When Blockstream didn’t immediately comply, the threat escalated: return funds on their terms, or BTC holders would face a 15% loss.
Blockstream characterized the entire episode as theft, rejecting the white-hat label outright. In the company’s view, a white hat discloses vulnerabilities responsibly and works with the affected team. They don’t drain funds first and negotiate afterward.
Blockstream confirmed it has engaged law enforcement agencies and forensic specialists to trace and recover the remaining funds through legal channels.
The precedent problem
Paying the ransom would have cost Blockstream roughly $47 million. The incident ranks among the largest single exploits in crypto this year. Liquid Network, launched in 2018, operates as a federated Bitcoin sidechain designed for faster settlement and confidential transactions, primarily serving exchanges and institutional traders. Its federation model relies on a consortium of functionaries who collectively manage the peg between Bitcoin and L-BTC.
Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy.
English (US) ·