Bitcoin Red Team Says Blockstream Ignored Security Emails Before Liquid Hack

The Bitcoin Red Team, a volunteer group that audits Bitcoin‑related projects, claims it warned Blockstream about a vulnerability that was later exploited to move almost 4,000 BTC from the Liquid Network.

Red Team’s Alleged Disclosure

Team co‑lead Calle said the group had previously reported the bug that enabled the theft. He criticized Blockstream for “selectively and inaccurately” referencing patches without providing a clear acknowledgment history.

Blockstream’s Response

Blockstream’s former CSO Samson Mow denied that any emails were ignored and said the accusations undermine the Red Team’s professionalism. Blockstream attributes the vulnerability to an “incorrect bug fix” applied to an AI‑identified issue.

Current Status of the Liquid Network

Liquid resumed block production on September 10, but transaction processing remains disabled. Peg‑outs are still halted as a precaution, and roughly 600 BTC remain missing from the exploit.

Implications

The incident highlights ongoing challenges in coordinating security disclosures for Bitcoin sidechains and raises questions about the effectiveness of communication between independent auditors and project teams.