【4000 BTC stolen from Liquid; white-hat returns 85%, with the remaining 600 BTC becoming a focal point of industry debate】
A hacker transferred 4,000 BTC out of the Liquid Federation wallet; currently about 3,400 BTC have been returned. The white-hat address still holds roughly 598.5 BTC (about 15% of the original amount transferred).
The central dispute concerns the nature of the remaining 600 BTC. While the white-hat hacker only left on-chain messages indicating they would return the “majority,” they did not explicitly state that the remainder was a bounty. Liquid’s official side has also not publicly confirmed agreement to pay a 15% fee. The industry has split clearly: the founder of Mist Security suggested an industry norm of a “default 15% bounty for large-scale theft”; however, Ledger CTO Charles Guillemet argued that the conduct lacked prior disclosure and on-chain encrypted contracts, and that the appearance is closer to extortion rather than a standard white-hat bounty.
This matter involves the security of the BTC reserves pool and the industry’s bounty standards. So far, neither Liquid nor Blockstream has made an official characterization of the 600 BTC. The key observation going forward is whether the project will confirm that this funding is a compliant reward, and whether the industry will form a standardized white-hat bounty agreement—factors that directly affect expectations for the safety of self-custodied assets like BTC.
A hacker transferred 4,000 BTC out of the Liquid Federation wallet; currently about 3,400 BTC have been returned. The white-hat address still holds roughly 598.5 BTC (about 15% of the original amount transferred).
The central dispute concerns the nature of the remaining 600 BTC. While the white-hat hacker only left on-chain messages indicating they would return the “majority,” they did not explicitly state that the remainder was a bounty. Liquid’s official side has also not publicly confirmed agreement to pay a 15% fee. The industry has split clearly: the founder of Mist Security suggested an industry norm of a “default 15% bounty for large-scale theft”; however, Ledger CTO Charles Guillemet argued that the conduct lacked prior disclosure and on-chain encrypted contracts, and that the appearance is closer to extortion rather than a standard white-hat bounty.
This matter involves the security of the BTC reserves pool and the industry’s bounty standards. So far, neither Liquid nor Blockstream has made an official characterization of the 600 BTC. The key observation going forward is whether the project will confirm that this funding is a compliant reward, and whether the industry will form a standardized white-hat bounty agreement—factors that directly affect expectations for the safety of self-custodied assets like BTC.