Blockstream

... just in case you missed last week's show.

Um, Liquid is Blockstream's Bitcoin side chain.

Um, you send Bitcoin to a federation of 15 functionaries, functionaries who lock it in reserve and issue you a-

A token

They kept 598 and a half Bitcoin, which, um, is roughly $50 million.

Jesus.

Uh, and in a later on, yeah, in a later on-chain messages, they, they call Blockstream, uh, quote, "Delusional, greedy and arrogant." Demanded it pay a 10% bounty from its own money or quote, "Cause all your holders a 15% loss." Basically, they're gonna keep the 600 Bitcoin.

And then they threatened to publish the private negotiations, so basically all of the encrypted messages that were going back and forth in these op_returns.

that.

Yeah, they preferred to communicate via on-chain, right? So I think email was offered by Blockstream, right? The company that...

One of the on-chain messages was send us a support or send us a bug ticket at support at Liquid Network or whatever.

And then it eventually... yeah came to um the attacker saying on chain attaching to it like a small bitcoin transaction you shall pay 10 using your own own money as bug bounty and that's where we stand right now uh so uh liquid bitcoin holders right now there's a 15 reserve shortfall uh because the attacker has not returned the entire amount they returned like 300 and 3400 i believe of the 4000 taken and they are retaining just under 600 btc so an ongoing situation right now

Yeah, and I think on September 11th, Friday, Blockstream, again, rejected the 10% bounty, and then they threatened law enforcement escalation unless the remaining funds were returned.

So interesting tactic.

Let's see if this works.

Yeah, another interesting tidbit, the attacker pointing out again in the on-chain messages that it's absurd how little Blockstream has spent monetarily on securing this massive stockpile of Bitcoin.

Um, there was something, um, on the network that refus- they refused actually a hacker's ransom, which was interesting, an interesting story from the weekend.

Basically, the background is Liquid is a Bitcoin side chain that is run by Blockstream.

Uh, basically in there you hold L BTC, Liquid BTC, um, a basically a voucher that is supposed to be backed one by one by real Bitcoin.

And alas, uh, last week a bug let a hacker to print, print more than 4K of those, uh, vouchers with no Bitcoin behind them.

Um, I mean, long story short, people are bullish on Blockstream for one reason, because they said no when the hacker demanded a 10% reward for the rest of the BTC that he has not gave back yet.

Um, they said no, they call it a crime, and they promised to cover all the missing BTC.

So this was kinda, e- end up being bullish for them, but definitely something that I think no company wants to go through, because you're actually taking your profits to cover something that is, that was going to be a user loss.

And I think quite rightfully, they said that they're going to work with criminal investigators and they're going to work with their own private investigators and analysts and whoever else to try and get the coins back.

And I think that hopefully the white hat hackers will turn around and try and negotiate an actual sum, which is not fair, but a sum which they can live with where they haven't got Blockstream and all their resources and all the resources of all their investors chasing them for the rest of time because those coins are worth an absolute fortune.

600 Bitcoin, that is something people are going to pursue.

Whereas if it was 1%, that's okay.

You're still walking away with whatever that is, 40 coins or something.

But that's a lot of Bitcoin.

So I think that's probably the best thing they could possibly do is just try and negotiate an amount of money, which would make Blockstream not... uh for the bounty which would make blockstream not pursue them to the ends of the earth trying to get the rest of the coins back um and also not to pursue criminal proceedings because you know you've you can have all the money in the world but if you're constantly looking over your shoulder then you can have a pretty miserable life um and just generally over the hack like It's just one of these things which in retrospect, it seems so obvious, but it wasn't that obvious because no one exploited the vulnerability earlier.

I actually think that it was more timed with Astra coming out on chat GPT or whatever.

There was, uh, no debate, uh, on this.

Um, and then so they simply stole 4,000 Bitcoin, and then they started to, uh, contact Blockstream, not through this, uh, the, their, uh, bounty program, uh, but on-chain.

Mm-hmm.

So directly on-chain, uh, they, uh, used OP_RETURN, uh, opcode.

Mm-hmm.

However, anyone, uh, can look at the blockchain and see what's, is written after the, after the OP-OP_RETURN code.

And then the attacker started to, uh, to write, to send message to, uh, Blockstream.

Uh, and Blockstream is the company-

Convenience is not redundancy.

Third, Blockstream refused to pay for the return of 598.5 Bitcoin still held after the liquid exploit.

Reports say the attackers had returned around 3,400 Bitcoin after Blockstream deployed a software patch.

Blockstream called the continued withholding of user funds theft rather than responsible disclosure.

It said it would pursue recovery with law enforcement, exchanges, service providers, and forensic specialists if necessary.

Reports also say the Federation operators were not hacked and private keys were not compromised.

The exploiter claimed that Blockstream had neglected protocol security spending.

The exploiter also threatened that holders would bear a 15% loss if Blockstream refused to pay.