# Blockstream Refuses 10% Bounty for 598 Bitcoin Still Held After Liquid Sidechain Drain

The company says it will involve law enforcement and exchanges instead of paying. Liquid bitcoin has resumed trading with on-chain reserves covering 85.15% of supply.

- Published: 2026-09-12T05:48:50.167Z
- Canonical: https://polylog.news/crypto/2026-09-12/blockstream-refuses-10-bounty-for-598-bitcoin-still-held-aft
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [Bitcoin Magazine](https://bitcoinmagazine.com/news/blockstream-tells-demands-bitcoin), [CryptoSlate](https://cryptoslate.com/l-btc-resumes-trading-with-reserves-covering-just-85-of-supply/), [Polylog editors](https://polylog.news)

Blockstream has told the group that drained its Liquid sidechain that it will not pay for the return of the remaining coins. "Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is theft," the company said in a statement [reported by Bitcoin Magazine](https://bitcoinmagazine.com/news/blockstream-tells-demands-bitcoin) and [circulated in French-language crypto channels](https://t.me/GokuCryptoNews/20612).

The mechanics of the attack are now documented. On September 6 the attackers exploited a range-proof verification cache defect in Elements, the software Liquid runs, and minted roughly 4,000 Liquid bitcoin (L-BTC) that the network accepted as fully collateralized. They then pegged out about 3,998.5 real bitcoin from the federation wallet, worth roughly $320 million at the time. This was not a smart-contract logic bug in an application. It was a failure in the cryptographic check that is supposed to make an unbacked mint impossible, which is the single assumption the entire peg depends on.

The group described itself as a white hat, sent encrypted vulnerability details, and demanded that every node be patched before it would return anything. After Blockstream replied with a signed confirmation, [3,400 bitcoin came back on September 7](https://www.coindesk.com/markets/2026/09/08/white-hat-hackers-return-most-of-usd320m-bitcoin-taken-from-liquid-network). The attackers kept 598.5 bitcoin, worth about $47 million, and then demanded a 10% bounty paid from Blockstream's own funds, warning through on-chain messages that Liquid holders would otherwise absorb a 15% loss. Blockstream said it will not accept a precedent in which open-source developers pay ransoms far larger than their economic stake in a network, and that it plans to involve law enforcement, exchanges, service providers and forensic specialists.

The shortfall is visible on-chain. A September 10 snapshot [put L-BTC backing at 85.15%](https://cryptoslate.com/l-btc-resumes-trading-with-reserves-covering-just-85-of-supply/) while federation peg-outs stayed suspended, and trading resumed on a venue where live depth is unmeasured. Holders can therefore transact a token that is currently not fully redeemable, at a price set by a market with no disclosed liquidity. Blockstream has said it intends to cover the shortfall, which converts a protocol failure into a corporate credit exposure.

The episode also challenges the informal norm that returning most of a theft earns a negotiated cut. Blockstream benefits from refusing, because paying would price every future vulnerability against its balance sheet. The attackers benefit from the norm holding, because it converts an exploit into a billable service. No third party has verified the group's identity or intent.

## What this means

A federated sidechain concentrates counterparty risk in one operator and one codebase, and Liquid users are now exposed on both counts: the token is 85% backed on-chain, redemptions are frozen, and full recovery depends on a private company choosing to absorb a $47 million loss. The wider channel runs through bitcoin-adjacent infrastructure generally, because exchanges and traders who used Liquid for fast settlement must reprice the assumption that a two-way peg is equivalent to holding bitcoin.

## What to watch

- Whether Blockstream reopens federation peg-outs and at what ratio, which will show whether it has funded the shortfall or is asking holders to wait.
- Whether the 598.5 bitcoin moves to an exchange or a mixing service, which would end the dispute over whether the group was negotiating or laundering.
- Whether other federated or bridged bitcoin wrappers publish proof-of-reserve snapshots in response, a sign that the market is starting to price wrapper risk separately from bitcoin risk.