Blockstream bets forensic tracing beats paying a $32m bounty for the last 598.5 BTC

The demand was 10% of 4,000 BTC, so 400 coins, and at the roughly $80,000 a coin implied by the $320 million Cointelegraph put on the September 6 withdrawal, that is about $32 million ^[1][1][2]. The attackers kept 598.5 coins, which Crypto Briefing values at about $47 million ^[3]. They are holding about one and a half times what they asked to be paid ^[3]. Paying would have bought back $47 million of Bitcoin for $32 million, a $15 million difference on the day ^[7]. Blockstream declined.

The 15% warning is not a separate threat. Of 4,000 coins, 598.5 is 14.96%, so the loss the attackers said Liquid holders would take is the amount already withheld ^[7][4]. It needs no further action from them.

"Taking assets without authorization and withholding their return is a crime, not responsible disclosure," Blockstream said Friday. "It is not white-hat activity. It is theft." ^[5] The company said it had engaged with the hackers in good faith to recover user funds but would not accept their demands ^[17]. The bounty demand reached the public through an onchain message shared by Jan3 chief executive and former Blockstream chief strategy officer Samson Mow ^[6].

What follows is not a lawsuit. Blockstream said it would work with law enforcement, exchanges, service providers and forensic specialists to trace the assets and identify those responsible ^[8]. Neither account names an agency, a jurisdiction or a case.

The two publishers also disagree on who moved the 3,400 BTC. Crypto Briefing describes Blockstream as recovering roughly 3,400 of the 4,000 coins drained, about 85% ^[15][4]. Cointelegraph says the actors returned 3,400 BTC after Blockstream said the affected bridge nodes had been patched ^[2]. In one version the patch got the money back; in the other the people holding the coins chose how much to hand over.

The bug sat in Elements, the open-source codebase under Liquid, and it allowed the creation of unbacked L-BTC that was then swapped for real Bitcoin out of the federation wallet ^[9]. The signing keys were not compromised and the multi-signature custody model held, so the failure was in how peg transactions were validated ^[10]. Liquid resumed block production on Thursday with empty blocks after emergency software updates, while transactions and Bitcoin transfers into and out of the network remained suspended ^[12].

The precedent argument is Blockstream's own. Crypto Briefing reports the company's view that compensating attackers is theft negotiation and would create a playbook for every future exploit ^[13]. That view is only priced if the tracing produces something: coins frozen at an exchange, or a name. If it does not, the figure left on the public record is a $47 million shortfall accepted to avoid a $32 million payment ^[3][2], and this ranks among the largest single exploits in crypto this year ^[16].