Key Takeaways
- Blockstream’s hackers demanded a 10% bounty while still holding 598.5 BTC.
- Liquid’s white hats returned 3,400 BTC, but the dispute kicked into high gear Sept. 9.
- Blockstream could face more disclosures if hackers publish their private key after the 10% dispute.
White Hats Come Out Swinging With 10% Demand
The latest message appeared on the Bitcoin blockchain through OP_RETURN, a feature that lets users attach small pieces of data to transactions. The same mechanism has become an unlikely communication channel between Blockstream and the group.
The hackers accused Blockstream of failing to adequately protect billions of dollars in assets, claiming the company allocated only $1.5 million, “maybe even 0,” toward security. The message called the alleged situation “a flagrant neglect of security and a sign of complete mismanagement.”
The claims about Blockstream’s security spending come directly from the hackers and have not been independently established by Bitcoin.com News.
598.5 BTC Remains at Center of Escalating Standoff
The message follows a wild ride that began Sept. 6, when the group drained nearly 4,000 BTC from Liquid’s reserves before identifying themselves onchain as white hats and asking Blockstream to contact them.
Blockstream subsequently communicated with the group through Bitcoin transactions and encrypted messages. On Monday, the hackers returned 3,400 BTC to the federation wallet but retained roughly 598.5 BTC.
That remaining stash is now at the center of the dispute. The group told Blockstream, “You SHALL pay 10% using your own money as bug bounty,” before warning that refusing could “cause all your holders a 15% loss.”
Hackers Say Private Conversations Could Be Published
The latest message also suggests the private side of the negotiations may eventually become public. The group suggested that it plans to “publish the privatekey to decrypt our conversations afterwards.”
If carried out, that could expose encrypted communications exchanged between Blockstream and the hackers during the negotiations, potentially providing more details about the vulnerability and discussions surrounding the returned bitcoin. Many of these messages were encrypted.
The hackers also argued that companies participating in bug bounty programs cannot guarantee complete security, while accusing Blockstream of remaining “delusional, greedy, and arrogant.”
Blockstream Standoff Is Not Out of the Woods Yet
On the flip side, calling the group white hats has become increasingly complicated. Keeping nearly 600 BTC while demanding payment and threatening additional losses raises questions about where vulnerability disclosure ends and coercion begins.
For now, the dust has hardly settled. The 598.5 BTC remains the biggest piece to watch, along with Blockstream’s response to the 10% demand and whether the hackers follow through on their promise to publish the keys needed to reveal their private communications.
