Liquid sidechain exploited; hackers demand 10% bounty, alleging Blockstream allocated only $1.5M to secure $5B in assets while network remains paused.
Security & Exploits ·
Parties involved in an ongoing dispute over a security breach at Liquid have escalated their rhetoric. Those claiming to be white-hat hackers have leveled accusations that Blockstream allocated only $1.5 million to secure $5 billion in assets, characterizing this as negligent. The hackers are now demanding a 10% bounty paid from Blockstream's own reserves, warning that refusal could result in a 15% loss for Liquid users, and have used harsh language to describe the company's approach to the matter.
The breach occurred on September 6 when approximately 4,000 BTC was withdrawn from Liquid's Federation wallet. Following Blockstream's confirmation that bridge nodes had been patched, roughly 3,400 BTC was returned, though about 598 units remain in the hackers' possession. Liquid's sidechain continues to remain offline as the company and Federation members work to resolve security vulnerabilities and address a chain split. Users have been instructed not to transfer Bitcoin to Liquid peg-in addresses until the network becomes operational.
Samson Mow, a former Blockstream executive, has challenged the hackers' position, suggesting they may underestimate the repercussions of their actions. He indicated the group has potentially revealed more identifying information than realized and questioned whether returning the funds would shield them from consequences. What remains unclear is whether further negotiations will occur or how law enforcement might become involved in tracking the remaining funds.