Blockstream bets forensic tracing beats paying a $32m bounty for the last 598.5 BTC

The demand was 10% of 4,000 BTC, so 400 coins, and at the roughly $80,000 a coin implied by the $320 million Cointelegraph put on the September 6 withdrawal, that is about $32 million ^[3][16][17]. The attackers kept 598.5 coins, which Crypto Briefing values at about $47 million ^[8]. They are holding about one and a half times what they asked to be paid ^[18]. Paying would have bought back $47 million of Bitcoin for $32 million, a $15 million difference on the day ^[20]. Blockstream declined.

The 15% warning is not a separate threat. Of 4,000 coins, 598.5 is 14.96%, so the loss the attackers said Liquid holders would take is the amount already withheld ^[11][19]. It needs no further action from them.

"Taking assets without authorization and withholding their return is a crime, not responsible disclosure," Blockstream said Friday. "It is not white-hat activity. It is theft." ^[9] The company said it had engaged with the hackers in good faith to recover user funds but would not accept their demands ^[15]. The bounty demand reached the public through an onchain message shared by Jan3 chief executive and former Blockstream chief strategy officer Samson Mow ^[10].

What follows is not a lawsuit. Blockstream said it would work with law enforcement, exchanges, service providers and forensic specialists to trace the assets and identify those responsible ^[12]. Neither account names an agency, a jurisdiction or a case.

The two publishers also disagree on who moved the 3,400 BTC. Crypto Briefing describes Blockstream as recovering roughly 3,400 of the 4,000 coins drained, about 85% ^[6][2]. Cointelegraph says the actors returned 3,400 BTC after Blockstream said the affected bridge nodes had been patched ^[1]. In one version the patch got the money back; in the other the people holding the coins chose how much to hand over.

The bug sat in Elements, the open-source codebase under Liquid, and it allowed the creation of unbacked L-BTC that was then swapped for real Bitcoin out of the federation wallet ^[4]. The signing keys were not compromised and the multi-signature custody model held, so the failure was in how peg transactions were validated ^[5]. Liquid resumed block production on Thursday with empty blocks after emergency software updates, while transactions and Bitcoin transfers into and out of the network remained suspended ^[21].

The precedent argument is Blockstream's own. Crypto Briefing reports the company's view that compensating attackers is theft negotiation and would create a playbook for every future exploit ^[13]. That view is only priced if the tracing produces something: coins frozen at an exchange, or a name. If it does not, the figure left on the public record is a $47 million shortfall accepted to avoid a $32 million payment ^[8][17], and this ranks among the largest single exploits in crypto this year ^[22].