Liquid Network Hacker Escalates, Demands 10% Bounty From Blockstream's Own Funds

Highlights

• The hacker behind Liquid Network's roughly $320 million BTC drain is now demanding Blockstream pay a 10% bug bounty out of its own funds.
• An on-chain message accuses Blockstream of spending only $1.5 million to secure $5 billion in assets.
• The hacker says refusing the demand will cause holders to lose 15%, and threatens to publish private keys tied to earlier negotiations.
• Roughly 600 BTC of the original haul remains unreturned after 3,400 BTC was sent back earlier.

The saga around Liquid Network's roughly $320 million bitcoin exploit has taken a new turn, with the attacker escalating its demands directly against Blockstream rather than simply keeping the funds already in hand. In a fresh on-chain message, the hacker accused Blockstream of investing just $1.5 million to secure a federation wallet holding roughly $5 billion in assets, and is now demanding the company pay a 10% bug bounty out of its own treasury — a different ask than simply retaining a cut of the stolen bitcoin, as had defined the standoff so far.

The exploit began on September 6, when roughly 4,000 of the network's BTC — worth about $320 million at the time — left Liquid's federation wallet, as CoinDesk reported when the attacker first claimed to be acting as a white-hat actor rather than a conventional thief. That framing set up days of on-chain negotiation between Blockstream and the hacker over how much of the funds would be returned versus retained as an informal "bounty" for exposing the vulnerability.

A Partial Return, Then a New Ultimatum

By Monday, the attacker had sent roughly 3,400 BTC back to Liquid, keeping 598.5 BTC — worth about $47 million, or roughly 15% of the original haul — according to reporting from The Record. That left around 600 BTC formally unresolved, with no public agreement between Blockstream and the attacker confirming the retained amount as a sanctioned bounty rather than a unilateral decision by the hacker to keep what it wanted. The new message adds two escalations to that unresolved balance: an explicit demand that Blockstream pay 10% of its own funds as a bounty — separate from whatever the hacker keeps of the stolen bitcoin — and a threat to publish private keys the attacker says are needed to decrypt earlier negotiation communications if the demand is refused.

Related: Liquid Network Attacker Returns 3,400 BTC, Keeps $47M as 'Bounty'

Why the Threat Carries Weight

Liquid Network is a Bitcoin sidechain built by Blockstream and used by several exchanges for faster, more private settlement of BTC transfers, which means its federation wallet security has direct implications for the institutions that route funds through it. The attacker's claim that Blockstream spent only $1.5 million protecting $5 billion in federation-held assets — even if inexact — has become the central talking point of the dispute, framing the incident as a security-investment failure rather than a sophisticated, unavoidable exploit. Whether or not that figure is precise, the sheer size of the gap between stated security spend and assets at risk is likely to draw scrutiny from Liquid's exchange partners regardless of how this specific ultimatum resolves. Liquid has operated since 2018 as one of the longer-running Bitcoin sidechains, giving exchanges a faster, more private settlement rail than mainnet transfers; an incident of this scale at a federation wallet institutions have trusted for years raises the stakes for every exchange that still routes BTC through it while the dispute remains unresolved.

What Happens Next

Blockstream has not publicly responded to the new 10%-bounty demand, and the network remains in the aftermath of the initial pause that followed the drain. The private-key threat adds urgency: if genuine, it could expose details of the earlier negotiation that neither side has made public, potentially embarrassing whichever party looks worse in the exchange. The immediate things to watch are whether Blockstream engages with the new demand at all, whether the roughly 600 BTC still outstanding gets formally resolved as a negotiated bounty or remains disputed, and whether the private keys the hacker is threatening to release actually surface. The network has largely stayed in the cautious posture it adopted right after Liquid paused following the initial $320 million drain, and that posture is unlikely to change until the bounty question is settled one way or another.

FAQ

What is the Liquid Network hacker now demanding?
The attacker is demanding Blockstream pay a 10% bug bounty out of its own funds, separate from the roughly 598.5 BTC (about $47 million) it has already kept from the original $320 million drain.

How much bitcoin was originally stolen?
Roughly 4,000 BTC, worth about $320 million at the time, left Liquid Network's federation wallet on September 6.

How much has been returned?
The attacker returned about 3,400 BTC on the Monday following the exploit, keeping roughly 600 BTC — about 15% of the total — without a publicly confirmed bounty agreement.

What happens if Blockstream doesn't pay?
The hacker has warned that refusing the new demand will cause holders to lose 15%, and has threatened to publish private keys tied to earlier negotiation communications.