Keon rejects Liquid attacker whitehat claim as extortion

A flawed software update just exposed the structural weakness of federated Bitcoin sidechains.

When a single transaction drained 4,000 Bitcoin from Blockstream's Liquid network, it created $320 million of unbacked sidechain tokens out of thin air. The vulnerability stemmed from a software fix designed to patch an earlier flaw. The attacker spotted the bad code, inflated their balance, and routed funds through Sideswap - a federated operator that lacked withdrawal limits or identity verification.

On Presidio Bitcoin Jam, the discussion highlighted how all 15 federation entities simply trusted Blockstream's software update. None ran independent code audits before approving the patch. The network restarted, but relying on a multi-sig federation proved no safer than trusting a single central provider.

The attacker left an on-chain OP_RETURN message claiming whitehat status, subsequently returning 3,400 Bitcoin while holding 600 Bitcoin - roughly $50 million - as a mandatory bounty. PGP-encrypted negotiations quickly broke down after the hacker threatened to broadcast private logs across the blockchain.

Two days later on Stacker News Live, host Keon rejected the whitehat framing outright. Keon argued that holding funds against an owner's consent is simple extortion, regardless of how polite the on-chain messages sound. Keon also criticized security researchers for seeking social media clout rather than quietly disclosing vulnerabilities.

Stacker News Live traced the stolen coins through CoinJoin mixers, ThorChain bridges, and Ethereum pools. While analytics continue closing complex hiding schemes, technical execution eventually collides with exchange surveillance and fiat exit ramps.

Codes break, federations freeze, and ledger history remains permanent.