Blockstream Rejects Hacker's $50M Bounty Demand After Liquid Sidechain Theft

The Theft and Recovery

On September 6, a vulnerability in Blockstream's Liquid sidechain allowed an attacker to create approximately 4,000 unbacked L-BTC tokens and withdraw roughly 3,996 real Bitcoin through the bridge. Rather than liquidating or moving the funds, the attacker has since initiated partial recovery, returning some of the stolen Bitcoin to Blockstream.

Blockstream's Rejection and the Standoff

The attacker is demanding approximately 600 Bitcoin—valued near $50 million at current prices—as a reward for returning the remaining stolen funds. According to CryptoSlate, Blockstream has rejected this demand, escalating a dispute over how the crypto industry should reward partial restitution. The disagreement reflects a broader question within the cryptocurrency industry: whether and how much to compensate someone who exploits a vulnerability but returns the stolen assets without ransom demands or public extortion.

Stakes and Precedent

Blockstream's refusal to pay the requested bounty represents a significant bet on its position. By rejecting the demand, the company is gambling that either the hacker will return the funds voluntarily, external pressure will convince them to do so, or the dispute will result in law enforcement involvement. The incident highlights tensions between bug-bounty conventions, which typically reward security researchers for disclosing vulnerabilities responsibly, and situations where an attacker has already stolen funds and is negotiating from a position of control over the assets.