- The white hat hackers behind the Liquid Network exploit only returned 85% of the stolen Bitcoin to Blockstream, leaving the group with 598.5 BTC worth around $47 million.
- Crypto community members criticized the exorbitant bounty fee the Liquid Network attackers charged, with many likening their approach to extortion.
The drama between a self-proclaimed “white hat” group and Blockstream, operator of the recently hacked Liquid Network, appears to have concluded. The culprits in the recent Liquid Network exploit that resulted in the loss of 4,000 Bitcoin (BTC) have returned “most” of the funds.
The perpetrators, who identified themselves as ethical hackers, kept roughly 15% of the funds as a bug bounty. This brings their earnings to 598.5 BTC from the incident, translating to more than $47 million at prevailing crypto exchange rates.
Red Flags on the Liquid Network White Hat Hackers’ Demands
Collection of a white hat bounty is a widely accepted industry practice, especially in the crypto space. It rewards independent security researchers who uncover critical protocol vulnerabilities and eventually work with the affected core developers to determine possible solutions to remediate system flaws before malicious actors can exploit them, which could lead to larger losses and reputational damage.
However, many considered the Liquid Network hackers’ approach to white hat as unorthodox, as they brute-forced Blockstream into patching up the compromised protocol before agreeing to return the stolen funds. They likened it to extortion because the perpetrators refused to return the funds unless they had proof Blockstream had already fixed the vulnerability.
Meanwhile, several critics called out the culprits for the excessive funds they have kept to themselves. Commonly accepted white-hat bounties normally charge around 5% to 10% for disclosing a vulnerability and subsequently returning stolen assets. These are typically capped at $10 million, though, making the Liquid Network hackers’ bill far higher than what was usually acceptable.
Additionally, people pointed out that something seemed wrong with the apparent lack of proper negotiation between Blockstream and the white hats. It appeared the hackers largely controlled communication using Bitcoin’s OP_RETURN function, which led them to unilaterally assign the 15% bounty without Blockstream’s prior approval.
The exorbitant fees could create a major deficit in the Liquid Network’s reserve backing relative to the circulating supply of its tokenized Bitcoin. It could erode Liquid Bitcoin’s (LBTC) capability to maintain a 1:1 peg with Bitcoin.
A Looming Lawsuit
While it’s too early to speculate, the event smells like a possible lawsuit. But then again, such an action would be detrimental to future white-hat security collaborations.
