A dispute between Blockstream and parties claiming to be white-hat hackers has escalated, with the hackers accusing the company of serious security failures and demanding a substantial financial settlement.
The hackers claimed that Blockstream allocated only $1.5 million, or possibly nothing, to secure $5 billion in assets on its Liquid sidechain. They characterized this as "flagrant neglect of security" and demanded a 10% bug bounty paid from Blockstream's own funds. The group warned that failure to comply could result in a 15% loss for Liquid users.
In communications attributed to the hackers, Blockstream was described as "delusional, greedy, and arrogant" over its security practices. The hackers also stated they intended to publish the private key needed to decrypt their conversations afterward.
Background on the Incident
Approximately 4,000 BTC, valued at around $320 million at the time, was withdrawn from Liquid's Federation wallet on September 6. The party responsible initially identified itself as white-hat hackers and said the funds would be returned once Blockstream addressed the security issue and patched affected nodes.
After Blockstream confirmed that bridge nodes had been patched, 3,400 BTC was returned to the Federation wallet. However, roughly 598 BTC remained with the hackers.
Blockstream's Response
Samson Mow, former Blockstream Chief Strategy Officer, warned the hackers about the consequences of their actions. He noted that Blockstream's decision to communicate through PGP was already a courtesy and questioned whether publicly admitting to taking the BTC and demanding a bounty was a prudent strategy.
Mow suggested the group had left behind more identifying clues than it might realize and cautioned that returning the funds does not necessarily guarantee they can walk away from the incident without consequences.
Meanwhile, Liquid has maintained a paused state on its sidechain as Blockstream and Federation members work on additional security fixes, address a chain split, and prepare for a coordinated restart. Users have been advised not to send Bitcoin to Liquid peg-in addresses until the network is operational.
