Blockstream Demands the 598 Bitcoin Liquid Attackers Kept as a Self-Declared Finder's Fee

Blockstream is publicly demanding the return of the bitcoin still held by the group that drained the Liquid Network last weekend. Attackers removed roughly 4,000 bitcoin, about $320 million at the time, from the federation wallet of the Bitcoin sidechain that Blockstream develops. The company disabled nodes and suspended transactions once it detected the withdrawal.

The group returned 3,400 bitcoin the following day, worth about $263 million, and kept 598.5 bitcoin, which it describes as a finder's fee. The retained amount is exactly 15 percent of what was taken, worth roughly $47 million at a bitcoin price near $78,500. The two sides first made contact through the OP_RETURN data field of a Bitcoin transaction sent from the address holding the funds, then moved to encrypted messages signed with keys that can be checked against Blockstream's published security key.

Blockstream attributed the incident to a software bug in Elements, the codebase Liquid is built on, rather than to compromised keys. The affected funds moved through SideSwap, an approved trading platform on the network, and SideSwap also pointed to the Elements bug as the root cause. No party has published a full technical postmortem of the defect.

Liquid is a federated sidechain. Bitcoin locked into it is held by a set of functionaries running a shared multisignature arrangement, and users hold a claim on that federation rather than on the Bitcoin base chain. That structure means a consensus-software bug and a custody failure are not separate categories here, because the same code governs who can move the pooled coins. The unresolved question is not whether the money can be recovered but whether an uninvited party gets to set its own fee for finding the hole.