Liquid Network Exploit Crossed Into Theft, Immunefi CEO Says

Here is the uncomfortable question the industry keeps dodging. If someone finds a hole, drains user Bitcoin, sends most of it back, and then names a price for the rest, is that still a rescue? Or did the rescue end the second the remaining coins stayed put? I have watched this argument flare up after almost every large incident, and this time the line feels sharper than usual.

When A Partial Return Stops Looking Like White-Hat Work

The Liquid Network incident did not stay in the gray zone for long. Unidentified actors pulled roughly 4,000 BTC, worth about $320 million at the time, then presented themselves as whitehats. After the affected bridge nodes were patched, they sent 3,400 BTC back. They kept 598.5 BTC. That leftover pile is the whole fight.

Mitchell Amador, founder and CEO of Immunefi, put it without much poetry. Coordinated disclosure, in his view, ends the moment a researcher sets the terms alone. The money was never theirs to save, so moving it is not a rescue. Keep a dollar of user funds and it is theft, whatever the opening intent looked like.

Coordinated disclosure ends the moment you set the terms yourself. The money was never yours to save, so moving it is not a rescue.

– Mitchell Amador

Blockstream rejected both the 10% bounty demand and the claim that the operation counted as responsible disclosure. Earlier talks, the company said, were about getting user funds home and protecting the broader Bitcoin community. Talking is not the same as blessing the withdrawal or the later invoice.

I find that distinction useful. Motive is a story people tell after the fact. Authorization is a yes or a no. Finding a real bug does not grant custody of other people’s coins, and it does not grant the right to write the check.

What Actually Broke On Liquid

The technical picture matters because it explains why this did not look like a stolen federation key. A cache-key collision in confidential transaction verification let the actors mint unbacked L-BTC. They then used a peg-out path through SideSwap and pulled real Bitcoin from the federation reserve.

Federation keys were not compromised. The issue sat in verification logic inside the Elements codebase. The nodes in play were running a release that did not include the relevant fix. That is a painful kind of failure. Not a smashed vault. A check that should have failed and did not.

Once unbacked paper can become reserved coin, the rest is logistics. Patch the bridge. Watch the return. Argue about the remainder. The remainder is where ethics, law, and market reputation collide.

Authorization Beats Intent Every Time

Amador’s standard is blunt on purpose. A researcher should use private channels, ideally a defined bounty program, instead of moving assets and negotiating afterward. Keep even a sliver of user funds and the label flips.

That will annoy people who still romanticize the lone operator who “saved” a protocol under fire. I get the romance. I also think it ages badly the moment the operator becomes the counterparty holding the bag.

• Private disclosure first, public theater later if ever
• No self-appointed custody of user balances
• No self-written invoice after the coins have already moved
• Scope, payout caps, and legal cover decided before the emergency

Without those rails, the project is bargaining under duress. Token holders are shouting. Service is strained. Every extra hour raises the chance that a partial return becomes the new normal.

Write Rescue Rules Before The Fire Starts

Amador’s practical advice is almost boring, which is why teams skip it. Rescue terms should exist before an exploit, not during the press cycle. Serious protocols decide in advance which systems may be tested, how a bug must be reported, and what a researcher may do while an incident is live.

Those same papers should state the maximum bounty, the payment conditions, and the legal protections for people who stay inside the approved box. Immunefi’s Whitehat Safe Harbor work is one attempt to freeze those conditions before anyone is staring at a draining bridge.

He used a house-fire comparison that stuck with me. Needing help does not authorize every possible method. You do not get to keep the silverware because you carried it onto the lawn.

Yes, rescue terms must exist ahead of an exploit. All serious protocols should set these in advance.

Advance rules also give a team a way to tell approved intervention from coercion. If the only document on the table is a message stuffed into a Bitcoin transaction, the actor who holds the coins is writing policy in real time. That is not a program. That is leverage.

How The Liquid Actors Actually Communicated

The group first spoke through messages placed in Bitcoin transactions. The ask was simple on the surface. Patch the flaw, then the funds come back. After Blockstream confirmed the affected bridge nodes were patched, 3,400 BTC moved back to the federation wallet.

No public agreement authorized the leftover 598.5 BTC. The retained amount also sits above 10% of the roughly 4,000 BTC in play, even though the reported demand circled a 10% reward. Numbers like that do not help the white-hat story. They make the story look like a negotiated cut.

Perhaps the most interesting part is not the on-chain theater. It is the absence of a pre-signed harbor. When there is no harbor, every returned sat looks like generosity and every kept sat looks like a fee.

The 10% Bounty Habit Still Has A Job

Amador still defends the industry’s loose custom of offering up to 10% of funds at risk when a team approves that figure in advance. Without a shared reference point, every settlement starts from zero. Starting from zero during an active drain hands extra leverage to whoever holds the coins.

A known percentage gives researchers a legal payment path and still lets a protocol recover most of what was exposed. Ten percent of a nine-figure incident is still a life-changing sum, earned without a forever chase. The other path is moving huge size on-chain while every forensics desk watches the hops.

Ten percent of a $100M exploit is $10M earned legally, with nobody hunting you afterwards. The alternative is moving nine figures onchain while every forensics firm watches.

The 10% figure has shown up in several recovery offers, but the project usually writes the terms. That is the hinge. A convention is useful. A convention imposed by the person holding the wallet is something else.

In one recent case, supporters around a Bitcoin payment stack backed a reward equal to 10% of recovered funds after attackers grabbed admin credentials, with a hard cap of 3 BTC if everything came home. Another protocol, after a large automated market maker failure, froze a big slice of funds with validator help and later posted a $5 million tip for information that could identify the attacker. Different math. Same idea. The team names the price.

Price The Reward So The Protocol Can Still Live

Amador’s pricing rule is simple enough to print on a wall. Aim for up to 10% of funds at risk, then clip that number to a cap the protocol can actually pay. Set it too low and theft starts to look rational. Set it too high and the rescue bill can finish the project the researcher claims to have saved.

Teams can still pay above the posted cap when a report deserves it. Under that model, the protocol keeps the last word. The researcher does not mint a fee by taking custody first.

I’ve found that tables like this calm a room faster than slogans. People stop arguing about purity and start arguing about process. Process is boring. Process is also how you avoid becoming the next case study.

United States Cases Show Why Unauthorized Access Is A Trap

For researchers sitting under U.S. law, sending money back or offering to talk does not automatically erase the first unauthorized step. In late 2023, a former security engineer pleaded guilty to computer fraud after exploiting two decentralized exchanges and taking more than $12 million. Prosecutors said he negotiated with one platform and proposed returning the stolen funds minus $1.5 million if the exchange stayed away from law enforcement.

He later agreed to forfeit more than $12.3 million, including about $5.6 million in fraudulently obtained crypto. In April 2024 a federal judge sentenced him to three years and ordered forfeiture of the stolen assets. Returning coins did not rewrite the access.

That history should sit next to every “we were only helping” message. Courts care about permission. Markets care about permission. Users care about permission. Intent is a character note. Access is the plot.

Why This Fight Will Keep Coming Back

Bridges, peg-outs, and confidential transaction plumbing are still where a lot of value sits in awkward intermediate states. A cache collision is not glamorous. It is exactly the kind of dull bug that prints real Bitcoin if the reserve will honor the paper.

Every cycle produces a new version of the same script. Actor moves funds. Actor claims rescue. Actor keeps a slice. Team says no. Community splits into two camps: the people who want coins home at any moral discount, and the people who refuse to let a drain become a pricing power.

I sit closer to the second camp, with one caveat. If a protocol never published a harbor, never posted a cap, and never staffed a disclosure channel, it helped create the vacuum. Vacuums get filled by whoever moved first.

What Protocols Should Publish This Quarter

Not a manifesto. A short, ugly, specific packet.

1. Name the systems in scope and the systems that are off limits.
2. Name the only accepted disclosure channel and the expected response window.
3. Name the maximum bounty as a percent and as a hard cap in the native asset.
4. Name what a researcher may and may not do during a live incident.
5. Name the legal safe harbor that applies if those rules are followed.
6. Name who can approve an exception when a report is unusually good.

If that packet exists, a later demand for 598.5 BTC has a document to crash into. If it does not exist, the demand becomes the document.

What Researchers Should Do Instead Of Taking Custody

Prove the bug with the smallest possible footprint. Prefer a private proof that cannot be replayed against users. If a program exists, use it. If it does not, still avoid becoming the custodian of the reserve.

Yes, that can feel slower. Yes, a team can ignore you. The ignored report is still cleaner than a self-granted lien on user Bitcoin. In my experience, the researchers who last in this industry are the ones who can live with being ignored for a week. The ones who cannot live with that start writing their own invoices.

Simple rule of thumb:
  Find the bug.
  Disclose in private.
  Let the team move funds.
  Get paid under posted terms.
  Do not become the bridge.

Users Are Not A Bargaining Chip

It is easy to talk about “the protocol” as if it were a single wallet. Liquid users, peg-out counterparties, and federation reserves are not one character in a heist film. When coins leave the reserve, someone on the other side of that peg is waiting on finality that just got political.

A partial return can look generous in a screenshot and still leave a hole in a treasury that was never designed to fund an unsolicited service fee. That is why Amador’s “keep a dollar and it is theft” line lands. The dollar is not symbolic. The dollar is someone else’s settlement.

The Reputation Cost Nobody Puts On A Spreadsheet

Even if no prosecutor ever knocks, the label sticks. White-hat is a scarce brand. Once a group keeps a nine-figure-adjacent remainder against the issuer’s will, later reports from the same cluster get read as opening bids. That is a career tax.

Projects pay a tax too. If they fold under pressure, every future incident starts at the last paid percentage. If they refuse, they spend months in public explaining why 3,400 BTC returned is not the end of the story. Neither tax is free. The cheaper tax is the one paid before the exploit, in policy paper and bounty copy.

A Cleaner Way To Think About “Funds At Risk”

People throw that phrase around as if it were a market price. It is not. Funds at risk should mean the value that a demonstrated path can actually extract under current live conditions, not a theoretical max if every module failed at once.

If a researcher can mint unbacked paper and peg it out, the risk is the reserve that will honor that paper. If federation keys are safe, do not inflate the story into a total chain collapse. Precision here is not pedantry. Precision is how you keep a 10% conversation from turning into a 15% conversation after the fact.

What I Would Tell A Board The Night After A Drain

First, patch. Second, recover what you can without blessing the method. Third, say in public that talks aimed at user recovery are not an admission that the withdrawal was authorized. Fourth, publish the bounty policy you should have published last year.

Do not haggle the remainder into a case study that teaches the next actor how to price a hostage. Pay for work that stayed inside the rails. Refuse payment that is just a kept pile with a press release taped to it.

Is that cold? A little. Markets are cold when other people’s balances are the collateral.

The Line That Should Be Printed In Every Bug Program

Moving user assets without permission is not a disclosure method. It is an incident. Returning most of the assets does not convert the incident into a consulting engagement. Keeping a remainder after the patch lands is the moment the white-hat story collapses.

Amador’s comments do not invent that line. They just say it in a week when the industry wanted a softer story. Soft stories are comforting. Soft stories also train the next drain.

So write the rules while the bridge is quiet. Cap the bounty while you can still afford the sentence. And if someone keeps 598.5 BTC after sending the rest home, call the leftover what it is. Not a tip. Not a custom. A cut that was never approved.

That is the whole argument, stripped of slogans. Permission first. Payment second. Custody never, unless the paperwork said so before the first coin moved.