# Victims Refuse Bounties and Escalate to Law Enforcement

Exploited crypto firms increasingly refuse the customary 10% whitehat bounty and route recovery through prosecutors and exchange freezes instead, so the informal negotiated-settlement norm that has governed large hacks erodes and attackers face a recovery process with no safe exit — raising the share of stolen funds that sit frozen or laundered rather than returned.

- Conviction: 36 / 100 (weakening)
- Horizon: Emerging (watchlist)
- Tracking since: 2026-09-12T00:00:00.000Z
- Last updated: 2026-09-14T14:04:09.447Z
- Canonical: https://polylog.news/crypto/trends/exploit-recovery-shifts-to-prosecution
- Publisher: Polylog
- Affected regions: Global

## Recent score history

- 2026-09-13: 38
- 2026-09-14: 36

## Recent evidence

- [confirms] Blockstream Demands the 598 Bitcoin Liquid Attackers Kept as a Self-Declared Finder's Fee (2026-09-13): Blockstream publicly demanded the 598 bitcoin back rather than accepting the attackers' self-awarded 15 percent fee, refusing to ratify the negotiated settlement. Each refusal of this kind removes the attacker's safe exit and pushes the residual balance toward freezing or laundering instead of a clean return.
- [confirms] Blockstream Refuses 10% Bounty for 598 Bitcoin Still Held After Liquid Sidechain Drain (2026-09-12): Blockstream publicly declined to pay a 10% bounty on the 598 bitcoin still held after the Liquid drain, saying it will work with law enforcement and exchanges instead. The $245 million theft ringleader pleading guilty in the US the same day shows the prosecutorial channel these firms are betting on is producing convictions.