Symbiosis offered a bounty. Blockstream refused a ransom. Who pays for recovery?
Symbiosis offered a timed white-hat bounty, as reported. Blockstream refused a demand for payment from its own funds. Users still need different recovery proofs.
Correction, September 12, 2026: An earlier version treated Symbiosis’s ~15 BTC recovery figure as the proven base for its 20% offer and presented ~60 BTC as 10% of the ~598.5 BTC remaining on Liquid. Those inferences are removed. The Liquid demand’s quoted wording asks for 10% paid from Blockstream’s own money without stating that denominator in the sentence we verified.
Symbiosis, as reported, offered a timed white-hat bounty. Blockstream refused a reported on-chain demand for payment from its own funds. Affected users still need different proofs of recovery.
In the same week, two bitcoin-bridge incidents produced competing recovery offers. The useful question is not which slogan sounds tougher. It is how much is requested, who supplies it, who receives it, and what happens to users’ missing funds.
What Symbiosis offered, as reported
According to PANews and Gate reporting of a Symbiosis disclosure, Symbiosis said an attacker exploited its Bitcoin Bridge on September 11 (Gate puts discovery near 04:28 UTC), suspended BTC routing, and kept other routes running. Those reports say the team recovered about 15 BTC into a team-controlled multisig and offered the attacker a white-hat bounty described as 20% of the recovered funds, valid until September 13 (cutoff time not specified in those reports). After that date, the same 20% would go to anyone whose information helps recover funds. Final loss and LP terms were still being calculated.
That wording, as reported, points to a percentage of “recovered funds.” It does not, by itself, prove whether the base is only the ~15 BTC already recovered, a larger recoverable amount, or another defined pool. Payment of the bounty is not established in the sources consulted for this article. Symbiosis’s own social post was not independently verified here; the terms are attributed to the secondary reports above.
What the Liquid counterparties demanded, as reported
After roughly 4,000 BTC left Liquid’s federation wallet on September 6 and about 3,400 BTC later returned, about 598.5 BTC remained outstanding in public accounting cited by Decrypt and Bitcoin.com News.
Reporting of an on-chain OP_RETURN message quotes the counterparties telling Blockstream: “You SHALL pay 10% using your own money as bug bounty,” with a warning that refusal could “cause all your holders a 15% loss.” In that quoted sentence, the payer is Blockstream’s own money and the payment recipient is the party making the demand. The sentence does not spell out the percentage’s denominator. Treating “10%” as automatically “10% of the 598.5 BTC remaining” is an inference, not a verified reading of that quote. The ~598.5 BTC figure remains the reported outstanding balance; the 15% holder-loss warning is a separate claim in the same message family.
Blockstream’s public refusal, as reproduced by Decrypt (article dated September 11, 2026; the embedded post UI may display a local evening time on September 10 depending on timezone), states:
Blockstream will not pay a ransom for the return of stolen funds. Taking assets without authorization and withholding their return is a crime, not responsible disclosure. It is not white-hat activity. It is theft.
Side by side, without invented arithmetic
| Term | Symbiosis (as reported by PANews/Gate) | Liquid counterparties / Blockstream (as reported) |
|---|---|---|
| Percentage offered/requested | 20% | 10% (“using your own money as bug bounty,” quoted) |
| Stated base | “Recovered funds” (exact composition not verified from primary post) | Not stated in the quoted OP_RETURN sentence |
| Nearby figure (not proven as the %) | ~15 BTC said recovered to a team multisig | ~598.5 BTC reported still outstanding after ~3,400 BTC returned |
| Who would pay | Unspecified in secondary reports beyond the bounty offer itself | Blockstream’s own money (per quoted demand) |
| Who would receive the payment | Attacker until Sep 13; tipsters after (as reported) | The counterparties making the demand |
| Users’ position | LPs await final loss and compensation terms | Holders face reported reserve gap and suspended peg-outs until recovery/coverage |
| Status | Offer reported; payout not established | Blockstream refusal published; no payment |
| Label used | “White hat bounty” (via secondary reports) | “Not white-hat… It is theft.” (Blockstream) |
Both episodes involve unauthorized creation or extraction of synthetic-BTC value and a fight over what, if anything, a returner should be paid. That shared outcome is not proof of identical exploit mechanics or identical custody models.
The incentive argument, from named public voices
CryptoSlate recorded the public disagreement after Blockstream’s refusal. Lorenzo Romagnoli argued that Blockstream was already unusually lucky to see most funds returned and that treating partial return like total retention could change the next grey-hat’s calculus. Samson Mow challenged the counterparties’ economics: bounty amounts “cannot be calculated based on the network’s overall total value,” and users’ assets must still be returned in full.
CryptoSlate · attributed remark · Sep 12, 2026
“Blockstream is already in the 1% of the 1% of luckiest hacked protocols on the planet.”
Those are attributable arguments about incentives. They are not a poll of the community, and they are not Block Magnates interviews.
What users still need to see
Symbiosis users / LPs
- A primary Symbiosis statement (or verified archive) spelling the bounty base and deadline timezone.
- Final loss accounting and concrete LP make-whole terms.
- Disposition of remaining unbacked syBTC and conditions for any BTC-route reopen.
Liquid / L-BTC holders
- Return or other coverage of the reported ~598.5 BTC outstanding.
- Federation notice that peg-outs resume, with any queues or caps.
- Reserve accounting converging toward the 1:1 claim SideSwap attributed to Adam Back.
For Liquid’s repair checklist, see Liquid’s Bitcoin Recovery Has Three Tests. For Symbiosis’s mint-versus-cash-out distinction, see Someone printed $46,000,000,000 of fake BTC and walked away with $336k.
Reporting note: Sources checked September 12, 2026. Symbiosis terms attributed to PANews and Gate. Liquid demand wording and Blockstream refusal attributed to Decrypt and Bitcoin.com News reporting of on-chain and X statements. Expert remarks from CryptoSlate. Research and writing used AI assistance.
