Blockstream and White‑Hat Group Clash Over 598.5 BTC

Blockstream is in a standoff with a group that identified itself as white hats after an exploit on the Liquid Network. The group returned 3,400 BTC to the federation wallet but retained roughly 598.5 BTC, demanding a 10% bounty and warning of a 15% loss for holders if the demand is not met.

Demand and Threat

The hackers used an OP_RETURN transaction on the Bitcoin blockchain to convey their demand: Blockstream must pay a 10% bounty from its own funds, or risk a 15% loss for Liquid holders. The message also accused Blockstream of insufficient security spending.

Potential Publication of Private Keys

The group indicated it might publish a private key that would decrypt encrypted communications exchanged with Blockstream during negotiations, potentially revealing details of the vulnerability and the settlement talks.

Background of the Exploit

On September 6, the group drained nearly 4,000 BTC from Liquid’s reserves, then identified themselves on‑chain as white hats and requested contact. Blockstream responded through Bitcoin transactions and encrypted messages. By Monday, most of the stolen funds had been returned.

Unresolved Issues

The remaining 598.5 BTC and Blockstream’s response to the 10% bounty demand are the key points to watch. The situation raises questions about the line between vulnerability disclosure and coercion.