{"id":78027,"date":"2026-09-11T15:14:10","date_gmt":"2026-09-11T15:14:10","guid":{"rendered":"https:\/\/crowdfundjunction.com\/blog\/blockstream-draws-line-after-4000-btc-hack-bitcoin-news\/"},"modified":"2026-09-11T15:14:10","modified_gmt":"2026-09-11T15:14:10","slug":"blockstream-draws-line-after-4000-btc-hack-bitcoin-news","status":"publish","type":"post","link":"https:\/\/crowdfundjunction.com\/blog\/blockstream-draws-line-after-4000-btc-hack-bitcoin-news\/","title":{"rendered":"Blockstream Draws Line After 4,000 BTC Hack \u2013 Bitcoin News"},"content":{"rendered":"<p><b>(Originally posted on : Bitcoin News )<\/b><br \/>\n<\/p>\n<div>\n<div class=\"@container mb-[25px] rounded-sm overflow-clip py-0.5 pr-0.5 pl-2.5 bg-success-100\">\n<div class=\"flex flex-col gap-m overflow-clip rounded-[6px] !bg-success-10 p-3 @[420px]:p-m\">\n<h2 class=\"m-0 flex items-center gap-s text-[19px] !text-[#1c1c1c] md:text-[20px]\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"16\" height=\"10\" viewbox=\"0 0 16 10\" fill=\"none\" class=\"shrink-0 text-success-100\" aria-hidden=\"true\"><path d=\"M1 1.5h14\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\"\/><path d=\"M1 8.5h10\" stroke=\"currentColor\" stroke-width=\"2.5\" stroke-linecap=\"round\"\/><\/svg><span>Key Takeaways<\/span><\/h2>\n<ul class=\"m-0 flex list-none flex-col gap-m pl-0\">\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Blockstream rejected a 10% bounty demand while hackers still hold roughly 598.5 BTC.<\/span><\/li>\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Liquid\u2019s attackers returned 3,400 BTC after draining nearly 4,000 BTC on Sept. 6.<\/span><\/li>\n<li class=\"m-0 flex items-start gap-s !text-[#434248]\"><span class=\"mt-2 size-2 shrink-0 rounded-full bg-success-100\" aria-hidden=\"true\"\/><span class=\"text-body\">Blockstream says law enforcement and exchanges could join the hunt for the remaining 598.5 BTC.<\/span><\/li>\n<\/ul>\n<\/div>\n<\/div>\n<h2>Nearly 4,000 BTC Left, but Most of It Came Back<\/h2>\n<p>The <a href=\"https:\/\/news.bitcoin.com\/security\/we-are-whitehats-nearly-4000-btc-drained-from-blockstreams-liquid-peg\/\">whole episode began Sept. 6<\/a> with something that already sounded strange enough: Nearly 4,000 BTC disappeared from reserves connected to Blockstream\u2019s Liquid Network, and the people responsible immediately announced on the Bitcoin blockchain that they were \u201cwhitehats.\u201d Then things got even stranger.<\/p>\n<p>The group began communicating with Blockstream through tiny bitcoin transactions carrying OP_RETURN messages, effectively turning <a href=\"https:\/\/news.bitcoin.com\/crypto-news\/blockstream-hackers-turn-bitcoin-into-a-wild-onchain-message-board\/\">the blockchain into a public message board<\/a>. After a series of public and encrypted exchanges, the group returned 3,400 BTC.<\/p>\n<p>But roughly 598.5 BTC stayed behind. That is where the story went off the rails.<\/p>\n<h2>A 10% Bounty Turns Into an Ultimatum<\/h2>\n<p>Instead of simply returning the rest, the group <a href=\"https:\/\/news.bitcoin.com\/crypto-news\/blockstream-hackers-demand-10-bounty-threaten-15-holder-loss\/\">demanded that Blockstream pay a 10%<\/a> bounty using its own money. It also warned that refusing the demand could leave Liquid holders facing a 15% loss. Calling this ordinary vulnerability disclosure became increasingly difficult.<\/p>\n<p>White-hat researchers generally identify security flaws, report them, and negotiate compensation through established channels. Here, nearly 600 BTC was being withheld while payment was demanded. Blockstream has now made clear that it sees the distinction very differently.<\/p>\n<p>\u201cBlockstream will not pay a ransom for the return of stolen funds,\u201d <a href=\"https:\/\/x.com\/Blockstream\/status\/2098281867908690394?s=20\" target=\"_blank\" rel=\"noopener noreferrer\">the company stressed on Sept. 11 on X<\/a>. \u201cTaking assets without authorization and withholding their return is a crime, not responsible disclosure.\u201d<\/p>\n<h2>Blockstream Says Bitcoin Holders Won\u2019t Pay the Bill<\/h2>\n<p>The company also rejected the idea that Liquid users should absorb losses to satisfy the demand. \u201cBitcoin is hard money and can\u2019t be minted without costs, Bitcoin doesn\u2019t haircut users to pay a ransom,\u201d Blockstream wrote.<\/p>\n<p>That line gets to the financial heart of the dispute. Someone ultimately has to account for the nearly 600 BTC that has not been returned. Blockstream\u2019s position is that users should not effectively finance a payout to the people who took it. The company said its earlier negotiations were conducted in good faith to recover user funds, not because it accepted the hackers\u2019 terms.<\/p>\n<h2>Security Warnings Add Another Twist<\/h2>\n<p>There is another complication hanging over the affair. Bitcoin Red Team co-lead Calle has <a href=\"https:\/\/news.bitcoin.com\/security\/bitcoin-red-team-claims-blockstream-ignored-warnings-before-hack\/\">claimed his group warned Blockstream<\/a> about the vulnerability before the exploit, quipping that it apparently cost \u201c600 BTC to ignore an email from the red team.\u201d<\/p>\n<p>Former Blockstream Chief Security Officer Samson Mow pushed back, saying no emails were ignored. The competing accounts have not been fully reconciled, and Bitcoin Red Team has said it intends to publish its own account of the disclosure process after Blockstream releases a postmortem.<\/p>\n<p>So Blockstream is now fighting two arguments at once: what happened before the exploit and what should happen to the bitcoin afterward. Beyond the loss of nearly 600 BTC, the company has also been forced to contend with the reputational fallout from the entire episode, which has quickly turned into a public relations disaster.<\/p>\n<p>\u201cWrite bad quality code, have bad problems,\u201d one X user <a href=\"https:\/\/x.com\/AnAustrianEcon\/status\/2098289251892826473?s=20\" target=\"_blank\" rel=\"noopener noreferrer\">wrote in reply to Blockstream\u2019s latest demand<\/a>. \u201cBitcoin is permissionless by design. Don\u2019t go crying to the authorities now that you messed up with bad code,\u201d the account added. \u201cBlockstream is shooting itself in the foot by backstabbing the guy who gave them 3,400 BTC,\u201d another X account wrote. <a href=\"https:\/\/x.com\/Kruwed\/status\/2098312847470301499?s=20\" target=\"_blank\" rel=\"noopener noreferrer\">The individual added<\/a>:<\/p>\n<blockquote>\n<p>\u201cNext time Liquid gets drained, they will keep 100% of the coins. Stop being so cheap and take responsibility for your f***up.\u201d<\/p>\n<\/blockquote>\n<h2>Blockstream Threatens a Much Bigger Hunt<\/h2>\n<p>Blockstream\u2019s latest message leaves little ambiguity about the second question.<\/p>\n<p>If the funds are not returned, the company says it plans to work with law enforcement, exchanges, service providers, forensic specialists and others to trace the bitcoin and identify the people responsible. The company also pointed to one inconvenient feature for anyone trying to make nearly 600 BTC disappear: Bitcoin transactions leave a permanent public trail.<\/p>\n<p>For a group that originally called itself white hat, the situation has traveled a long way from a bug report. Nearly 4,000 BTC left. Most came back. Hundreds of bitcoin did not. And Blockstream\u2019s answer to the remaining demand is now four words long:<\/p>\n<blockquote>\n<p>\u201cReturn the bitcoin.\u201d<\/p>\n<\/blockquote><\/div>\n<p><a href=\"https:\/\/news.bitcoin.com\/crypto-news\/return-the-bitcoin-blockstream-draws-line-after-4000-btc-hack\/\">Source link <\/a><br \/>\n<br \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>(Originally posted on : Bitcoin News ) Key Takeaways Blockstream rejected a 10% bounty demand while hackers still hold roughly 598.5 BTC. Liquid\u2019s attackers returned 3,400 BTC after draining nearly 4,000 BTC on Sept. 6. Blockstream says law enforcement and exchanges could join the hunt for the remaining 598.5 BTC. Nearly 4,000 BTC Left, but [&hellip;]<\/p>\n","protected":false},"author":19,"featured_media":78028,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0},"categories":[32],"tags":[],"_links":{"self":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/78027"}],"collection":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/comments?post=78027"}],"version-history":[{"count":0,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/78027\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media\/78028"}],"wp:attachment":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media?parent=78027"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/categories?post=78027"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/tags?post=78027"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}