The group behind the Liquid Network exploit has demanded Blockstream pay a 10% bug bounty from its own funds, warning that refusal could cost holders a 15% loss. The hackers still hold roughly 598.5 BTC after returning 3,400 BTC earlier this week, and say they may publish a private key exposing their encrypted talks with Blockstream.
Hackers demand a 10% bounty
The group calling itself white hats demanded a 10% bug bounty from Blockstream on Wednesday, escalating a standoff that began after nearly 4,000 BTC was drained from the Liquid Network. The message arrived through OP_RETURN, a Bitcoin feature that lets users attach small pieces of data to transactions — the same channel the group has used to communicate with Blockstream throughout the dispute.
Meanwhile, the hackers accused Blockstream of failing to protect billions of dollars in assets, claiming the company allocated only $1.5 million toward security, or possibly nothing at all. These claims come directly from the hackers and have not been independently established by Bitcoin.com News.
598.5 BTC still in dispute
The latest message follows a wild ride that began September 6, when the group drained nearly 4,000 BTC from Liquid's reserves before identifying itself onchain and asking Blockstream to make contact. Blockstream then communicated with the group through Bitcoin transactions and encrypted messages. On Monday, the hackers returned 3,400 BTC to the federation wallet but kept roughly 598.5 BTC.
That remaining stash now sits at the center of the standoff. The group told Blockstream: "You SHALL pay 10% using your own money as bug bounty", before warning that refusing could cause holders a 15% loss.
Private key threat looms
The hackers also said they plan to publish the private key needed to decrypt their conversations with Blockstream. If carried out, that could expose encrypted messages exchanged during the negotiations, potentially revealing more about the vulnerability and the discussions around the returned bitcoin.
Meanwhile, the group argued that companies running bug bounty programs cannot guarantee complete security, while describing Blockstream in harshly negative terms. Still, keeping nearly 600 BTC while demanding payment and threatening further losses raises questions about where vulnerability disclosure ends and coercion begins. For now, the 598.5 BTC remains the biggest piece to watch, along with Blockstream's response and whether the hackers follow through on releasing the keys.
Source: Bitcoin News
Trading involves risk.
Risk Disclaimer
