Blockstream Refuses the 10% Cut White Hat Hackers Have Learned to Expect

Blockstream will not pay the attackers who drained its Liquid sidechain. The refusal breaks with a crypto habit of letting self-declared white hat hackers keep a slice of what they took.

Liquid is a Blockstream-built network where users lock Bitcoin (BTC) and receive a matching token that moves faster. Attackers exploited a software flaw on September 6 and took roughly 4,000 BTC.

Why White Hat Hackers Learned to Expect a Cut The flaw let the attackers create Liquid tokens that no real Bitcoin backed, then convert them out. Federation signing keys were never stolen, which is why the transaction that drained Liquid cleared normally.

They later returned 3,400 BTC once Blockstream patched the software, then asked for a retroactive bug bounty. They kept 598.5 BTC, worth about $46 million at current Bitcoin prices. That demand follows a script.