Symbiosis offered a bounty. Blockstream refused a ransom. Who pays for recovery?
Symbiosis offered a timed white-hat bounty, as reported. Blockstream refused a demand for payment from its own funds. Users still need different recovery proofs.
The same week left two recovery playbooks on the table. Symbiosis offered a timed white-hat share on a recovery it put near 15 BTC. Blockstream publicly refused an on-chain demand after Liquid still had about 598.5 BTC outstanding — Decrypt framed that remainder near $47M. The stories are not the same size or the same exploit. What they share is a fight over payment terms that still lack a clean, stated base.
What Symbiosis offered
In a September 11, 2026 post (16:04 UTC), Symbiosis said an attacker hit its Bitcoin Bridge that morning, halted BTC routes, and recovered about 15 BTC to a team multisig. It offered the attacker a white-hat bounty of “20% of the funds” until September 13, 2026, then the same share to tipsters. LP make-whole details were still forthcoming. A bounty payout is not established in the sources checked here.
PANews paraphrased that as 20% of the recovered funds. Symbiosis did not. “The funds” is undefined relative to the ~15 BTC already recovered.
What the Liquid demand says on-chain
After roughly 4,000 BTC left Liquid’s federation wallet on September 6 and about 3,400 BTC later returned, about 598.5 BTC remained outstanding in public reports.
The demand is on Bitcoin mainnet. Transaction f7055f6c…9588 (confirmed 2026-09-09 11:45:49 UTC) carries this OP_RETURN in full:
Your dereliction of duty is obvious that you allocated only $1.5M (maybe even 0) to secure $5B assets. This is a flagrant neglect of security and a sign of complete mismanagement. You SHALL pay 10% using your own money as bug bounty or you will cause all your holders a 15% loss for your irresponsibility and stinginess. Even companies that participate in bug bounty programs cannot guarantee complete security, let alone one like yours that remains delusional, greedy, and arrogant to this very day. Anyway we are going to publish the privatekey to decrypt our conversations afterwards.
From that text and the same transaction’s outputs:
- The demand names Blockstream’s own money as the payer.
- It states “10%” and a separate “15% loss” threat for holders — with no calculation base for the 10%.
- The same transaction outputs 598.50010393 BTC to a bech32 address. That matches the reported outstanding balance. It is an adjacent UTXO, not a stated bounty denominator.
Blockstream’s public line, as reported by Decrypt (Sep 11, 2026):
Blockstream will not pay a ransom for the return of stolen funds. Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is theft.
A public refusal is not proof that no payment happened later.
Side by side
| Term | Symbiosis | Liquid demand / Blockstream |
|---|---|---|
| Scale in play | ~15 BTC recovered (Symbiosis) | ~598.5 BTC outstanding (~$47M in Decrypt framing) |
| Ask / offer | 20% “of the funds” | 10% “using your own money as bug bounty” |
| Stated base | Not defined | Not defined in the OP_RETURN |
| Who pays | Unclear beyond the bounty offer | Blockstream’s own money |
| Deadline | Sep 13, 2026 (no clock) | None; 15% holder-loss threat |
| Status | Offer published; payout not shown | Publicly refused; later payment not shown |
Treat them as contrasting policy choices in one news week, not as one interchangeable “bridge bounty” case.
The incentive fight
CryptoSlate framed the argument after the refusal. Lorenzo Romagnoli’s point, as summarized there: protocols that punish partial returns risk teaching the next actor that keeping everything is safer than giving most of it back. Samson Mow rejected the counterparties’ economics — bounty amounts “cannot be calculated based on the network’s overall total value,” and users’ assets must still be returned in full.
CryptoSlate · Sep 2026
“[P]rotocols that punish partial returns risk teaching the next actor that keeping everything is safer than giving most of it back.”
What users still need
Symbiosis users / LPs
- What “the funds” means for the 20% base, and any Sep 13 cutoff time.
- Final loss accounting and make-whole terms for affected LPs.
- What happens to remaining unbacked syBTC and when BTC routes reopen.
Liquid / L-BTC holders
- Return or other coverage of the reported ~598.5 BTC outstanding.
- Notice that peg-outs resume, with any queues or caps.
- Reserve accounting that converges on the 1:1 claim SideSwap attributed to Adam Back.
Liquid’s holder checklist: Liquid’s Bitcoin Recovery Has Three Tests. Symbiosis mint vs cash-out: Someone printed $46,000,000,000 of fake BTC and walked away with $336k.
Reporting note: Sources checked September 13, 2026. Symbiosis: @symbiosis_fi. Liquid demand: mempool f7055f6c…9588. Refusal: Decrypt. Incentive remarks: CryptoSlate. Orange marks on evidence figures are ours. Dollar framing for Liquid’s outstanding remainder follows Decrypt, not a Block Magnates price. Research and writing used AI assistance.
