- Bitcoin Red Team claims Blockstream received security warnings before the Liquid exploit.
- An attacker removed 4,000 BTC from Liquid federation reserves before returning 3,400 BTC.
- Adam Back linked the exploit to an incorrect fix for a separate vulnerability.
Blockstream rejected a payment demand after an attacker removed 4,000 BTC from Liquid’s federation reserves. The company called the withdrawal theft and requested 598.5 BTC held by the attacker.
The attacker returned 3,400 BTC after on-chain discussions. However, it withheld the balance while seeking a 10% bounty. Blockstream said it “will not pay a ransom for the return of stolen funds.”
Calle Says Blockstream Received an Earlier Warning
Bitcoin Red Team co-lead Calle connected the unpaid balance to a security report sent before the Sept. 6 exploit. “Turns out it only costs you 600 BTC to ignore an email from the red team,” he wrote.
In a follow-up, Calle challenged Adam Back’s description of the vulnerability’s severity and development. He said Blockstream received several reports but had not supplied a history of acknowledgements and patches.
Bitcoin Red Team plans to publish its disclosure record after Blockstream restores normal operations and releases a postmortem. Former Blockstream security chief Samson Mow disputed Calle’s account and said Blockstream ignored no emails.
Adam Back Links Exploit to an Incorrect Fix
Blockstream CEO Adam Back said two issues interacted to create the exploited condition. He described both issues as non-critical.
Back, said developers, introduced the exploitable bug through an incorrect fix for a separate vulnerability found using artificial intelligence. He also pointed to Blockstream’s history of open security collaboration and code review.
Blockstream has not yet published the promised technical postmortem. Available statements do not establish whether Bitcoin Red Team reported the exact exploit path or a related weakness.
Liquid resumed block production on Sept. 10, followed by transaction processing. Peg-outs stayed disabled as a precaution while federation members continued their security review.
Blockstream said it would involve law enforcement, exchanges, service providers, and forensic specialists if the remaining bitcoin was not returned.
Related: Bitcoin Faces $76,487 Test Before CPI as XRP $1.32 Breakdown Raises Alarm
Disclaimer: The information presented in this article is for informational and educational purposes only. The article does not constitute financial advice or advice of any kind. Coin Edition is not responsible for any losses incurred as a result of the utilization of content, products, or services mentioned. Readers are advised to exercise caution before taking any action related to the company.
