Hackers Stole 4,000 BTC From Blockstream's Liquid Sidechain, and Now They're Negotiating
White hat hackers walked away with over 4,000 Bitcoin from Blockstream's Liquid sidechain, and now they want to keep a portion as a bounty reward before returning the rest.
Blockstream isn't playing ball.
The company behind one of Bitcoin's most prominent sidechains publicly told the hackers to return the remaining funds, rejecting any informal arrangement that lets the attackers pocket a self-determined reward. The standoff puts Blockstream in an uncomfortable position: publicly demand everything back and risk the hackers going silent, or negotiate and set a precedent that raiding infrastructure pays.
What Actually Happened on Liquid
Liquid is a Bitcoin sidechain built by Blockstream, designed for faster settlements and confidential transactions. It's used by exchanges, traders, and institutions who want Bitcoin's security without waiting on-chain. The idea is that it's supposed to be battle-tested and trustworthy infrastructure.
The hackers who targeted it describe themselves as white hats, meaning they exploited the vulnerability to expose it rather than sell it to bad actors or liquidate everything immediately. That framing matters, because it's the entire basis of their argument for keeping a cut. In traditional bug bounty culture, finding a critical flaw earns a reward. These hackers appear to have decided to set their own terms rather than go through official channels first.
That distinction, white hat versus unauthorized attacker, is legally and reputationally significant. Without prior agreement from Blockstream, taking funds and then demanding payment to return them sits in deeply uncomfortable legal territory regardless of intent.
Why This Matters Beyond Blockstream
The Liquid network holds real Bitcoin. If users and exchanges lose confidence that funds on the sidechain are secure, or that governance disputes get resolved cleanly, adoption stalls. For Blockstream, this isn't just a PR crisis. It's a test of whether Liquid can be trusted at institutional scale.
The broader DeFi and Bitcoin sidechain ecosystem is watching closely. Every protocol with a bug bounty program is taking notes on how this negotiation plays out. If hackers can drain a network, demand terms, and receive any portion of stolen funds without formal agreement, it reshapes how future attackers calculate risk versus reward.
What to Watch Right Now
Track whether Blockstream issues a formal on-chain or public resolution in the next 48 to 72 hours. If funds begin moving without an announced settlement, assume the situation deteriorated. Anyone holding assets on Liquid should monitor official Blockstream communications before making new deposits. Until this closes cleanly, treat Liquid capacity as temporarily compromised and size exposure accordingly.