Blockstream Refuses the 10% Cut White Hat Hackers Have Learned to Expect

Blockstream won’t pay the attackers who drained its Liquid sidechain. The refusal breaks with a crypto behavior of letting self-declared white hat hackers preserve a slice of what they took.

Liquid is a Blockstream-built community the place customers lock Bitcoin (BTC) and obtain an identical token that strikes quicker. Attackers exploited a software program flaw on September 6 and took roughly 4,000 BTC.

Why White Hat Hackers Learned to Expect a Cut

The flaw let the attackers create Liquid tokens that no actual Bitcoin backed, then convert them out. Federation signing keys had been by no means stolen, which is why the transaction that drained Liquid cleared usually.

They later returned 3,400 BTC as soon as Blockstream patched the software program, then requested for a retroactive bug bounty. They saved 598.5 BTC, value about $46 million at current Bitcoin prices.

That demand follows a script. Nomad, a bridge that misplaced $190 million in 2022, publicly offered hackers 10% of the haul to ship the relaxation again. Projects have copied the association since.

Blockstream Says the White-Hat Label Does Not Fit

Blockstream stated in its statement that open-source builders mustn’t fund payouts far bigger than their very own stake in a community.

Taking property with out authorization and withholding their return is against the law, not accountable disclosure. It shouldn’t be white-hat exercise. It is theft.

Ledger Chief Technology Officer Charles Guillemet questioned the white hat declare days earlier. Attackers who empty a bridge after which invite contact aren’t doing safety analysis, he argued.

The firm shouldn’t be alone in refusing. Kraken accused safety researchers of extortion in 2024 after they took $3 million and set their very own worth for returning it.

BeInCrypto reported on September 7 that the partial return nonetheless left practically 600 BTC excellent. That hole has not closed, and Blockstream has not stated publicly who absorbs it if the cash by no means come again.

Recovery now rests on legislation enforcement, exchanges, and chain forensics aimed toward actors no one has recognized. Whether the refusal holds will form what the subsequent attacker asks for.

The put up Blockstream Refuses the 10% Cut White Hat Hackers Have Learned to Expect appeared first on BeInCrypto.